Proposal for a directive European Parliament and of the Council on Payment services and electronic money services in the Internal Market amending Directive 98/26/EC and repealing Directives 2015/2366/EU and 2009/110/EC

5.5.2026

PROVISIONAL AGREEMENT RESULTING FROM INTERINSTITUTIONAL NEGOTIATIONS

Subject: Proposal for a directive European Parliament and of the Council on Payment services and electronic money services in the Internal Market amending Directive 98/26/EC and repealing Directives 2015/2366/EU and 2009/110/EC

(COM(2023)0366 – C90218/2023 – 2023/0209(COD))

The interinstitutional negotiations on the aforementioned proposal for a directive have led to a compromise. In accordance with Rule 75(4) of the Rules of Procedure, the provisional agreement reproduced below is submitted to the Committee on Economic and Monetary Affairs for decision by way of a single vote.

2023/0209 (COD)

Proposal for a

DIRECTIVE OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL

on payment services ▌ in the internal market amending Directive 98/26/EC and repealing Directives (EU) 2015/2366 and 2009/110/EC

(Text with EEA relevance)

THE EUROPEAN PARLIAMENT AND THE COUNCIL OF THE EUROPEAN UNION,

Having regard to the Treaty on the Functioning of the European Union, and in particular Articles 53 and 114 thereof,

Having regard to the proposal from the European Commission,

After transmission of the draft legislative act to the national parliaments,

Having regard to the opinion of the European Economic and Social Committee,

▌

Acting in accordance with the ordinary legislative procedure,

Whereas:

(1) Since the adoption of Directive (EU) 2015/2366 of the European Parliament and of the Council3, the retail payment services market underwent significant changes largely related to the increasing use of cards and other digital means of payment, the decreasing use of cash and the growing presence of new players and services, including digital wallets and contactless payments. The Covid-19 pandemic and the transformations it brought to consumption and payment practices has increased the importance of having secure and efficient digital payments.

(2) The Communication from the Commission on a Retail Payments Strategy for the EU4 announced the launch of a comprehensive review of the application and impact of Directive (EU) 2015/2366 “which should include an overall assessment of whether it is still fit for purpose, taking into account market developments”.

(3) Directive (EU) 2015/2366 aimed at addressing barriers to new types of payment services and improving the level of consumer protection and security. The evaluation of the impact and application of Directive (EU) 2015/2366 by the Commission found that Directive (EU) 2015/2366 has been largely successful with regard to many of its objectives, but also identified certain areas where the objectives of the Directive have not been fully achieved. In particular, the evaluation identified problems regarding divergent implementation and enforcement of Directive (EU) 2015/2366, which have directly impacted competition between payment service providers, by leading to effectively different regulatory conditions in Member States because of different interpretation of the rules, encouraging regulatory arbitrage.

(4) There should be no room for ‘forum shopping’ where payment service providers ▌ choose, as home country, those Member States where the application of Union rules on payment services is more advantageous for them and provide cross-border services in other Member States which apply stricter interpretation of the rules or apply more active enforcement policies to payment service providers established there. That practice distorts competition. The Union rules on payment services should be harmonised by incorporating rules governing the conduct of payment services in a Regulation and separating them from the rules on authorisation and supervision of payment institutions, which should be governed by this Directive ▌ , and not continue to be governed by ▌ Directive (EU) 2015/2366.

(5) Even though the issuance of electronic money is regulated under Directive 2009/110/EC of the European Parliament and of the Council,5 the use of electronic money to fund payment transactions is to a very large extent regulated by Directive (EU) 2015/2366. Consequently, the legal framework applicable to electronic money institutions and payment institutions, in particular with regard to the conduct of business rules, is already substantially aligned. Over the years competent authorities in charge of authorisation and supervision of payment institutions and electronic money institutions have experienced practical difficulties in clearly delineating the two regimes and in distinguishing electronic money products and services from payment and electronic money services offered by payment institutions. This has led to concerns about regulatory arbitrage and an uneven ▌ playing field, as well as issues related to the circumvention of the requirements of Directive 2009/110/EC where undertakings that intend to issue electronic money take advantage of the similarities between payment services and electronic money services and apply for authorisation as a payment institution. It is therefore appropriate to further align the authorisation and supervision regime applicable to electronic money institutions ▌ with the regime applicable to payment institutions. However, the authorisation requirements, in particular initial capital and own funds, and some key basic concepts governing the electronic money business, including the issuance of electronic money, electronic money distribution and redeemability, are distinct from the services provided by payment institutions. It is therefore appropriate to preserve these specificities when combining the provisions of Directive (EU) 2015/2366 and Directive 2009/110/EC.

(6) As evidenced in the review conducted by the Commission and given the evolution of the respective markets, businesses and risks ▌ , it is necessary to update the prudential regime for payment institutions, including those issuing electronic money as a payment service, by requiring a single authorisation for providers of payment services which do not take deposits. The authorisation regime for payment institutions, which will replace the regime applicable to electronic money institutions, should also apply to issuers of electronic money tokens that are not credit institutions and references in Regulation (EU) 2023/1114 to electronic money institutions issuing electronic money tokens should be read as references to payment institutions issuing electronic money tokens. However, the specificities of the regime established by Regulation (EU) 2023/1114 as regards electronic money institutions issuing electronic money tokens should be maintained taking into account Article 48(3) of that Regulation. The prudential regime applicable to payment institutions should be based on an authorisation, subject to a set of strict and comprehensive conditions, for legal persons offering payment services when not taking deposits. The prudential regime applicable to payment institutions should ensure that the same conditions apply Union-wide to the activity of providing payment services.

(6a) In order to avoid unnecessary burden, it is important to ensure that streamlined procedures are in place for those undertakings that have been authorised as crypto-asset service providers in accordance with Article 63 of Regulation (EU) 2023/1114 and that apply for authorisation to provide payment services under this Directive. In that respect, it is necessary to make maximum use of the information that those undertakings provided during their crypto-asset service provider authorisation process. Therefore, those undertakings should submit information that overlaps with information previously provided during the authorisation procedures under Regulation (EU) 2023/1114 in its original form, provided that such information is still up-to-date. In cases where such information is no longer up-to-date, those undertakings should provide the updated information and documentation whilst indicating where such updates have been made.

(7) It is appropriate to dissociate the service of enabling cash to be withdrawn from a payment account from the activity of servicing a payment account, as the providers of cash withdrawal services may not service payment accounts. The services of issuing payment instruments and of acquiring payment transactions, which were listed together in point 5 of the Annex to Directive (EU) 2015/2366 as if one could not be offered without the other, should be presented as two different payment services. Listing issuing and acquiring services separately should, together with distinct definitions of each service, clarify that the issuing and acquiring services may be offered separately by payment service providers.

(8) Taking into account the rapid evolution of the retail payments market, and the constant new offering of payment services and payment solutions, it is appropriate to adapt some of the definitions under Directive (EU) 2015/2366, such as the definition of payment account, funds and payment instrument, to the realities of the market to ensure that Union legislation remains fit for purpose and technology neutral. To ensure consistency with the PSR, certain definitions are part of [PSR] and referenced in this Directive.

▌

(13a) The clarification of the process and the various steps to be followed for the execution of a payment transaction is of significant importance for the rights and obligations of the parties involved in a payment transaction and for the application of strong customer authentication. The process leading to the execution of a payment transaction is either initiated by the payer or on his/her behalf, or by the payee. The payer initiates the payment transaction by placing a payment order. Once the payment order is placed, the payment service provider checks if the transaction has been authorised and authenticated including, where applicable, by applying strong customer authentication, and the payment service provider then validates the payment order. The payment service provider then takes the relevant steps to execute the payment transaction, including the transfer of funds.

(14) Money remittance is a payment service that is usually based on cash provided by a payer to a payment service provider without any payment accounts being created in the name of the payer or the payee which remits the corresponding amount, to a payee or to another payment service provider acting on behalf of the payee. In some Member States, supermarkets, merchants and other retailers provide to the public a service enabling them to pay utilities and other regular household bills. Those bill-paying services should therefore be treated as money remittance.

▌

(16) Regulation (EU) 2023/1114 of 31 May 2023 lays down that electronic money tokens, as defined in that Regulation, are deemed to be electronic money. References to electronic money in this Directive should therefore be understood to include electronic money tokens, and electronic money tokens shouldbe includedin the definition of funds. However, the specificities of the regime established by Regulation (EU) 2023/1114 should be maintained. Therefore, the mere issuance of electronic money tokens should not trigger the authorisation requirements established in this Directive if the issuer is already authorised as a crypto-asset service provider or credit institution under Regulation (EU) 2023/1114, except where payment services are provided.Providing transfer services for crypto-assets on behalf of clients, as defined in Regulation 2023/1114, with electronic money tokens, could qualify as the payment service of execution of payment transactions, including when such transfers are provided as part of other crypto-asset services, unless such transfers are covered by a specific exclusion from the scope of this Directive and Regulation xx [PSR]. For example, the service of custody and administration of crypto-assets on behalf of clients, as defined in Regulation (EU) 2023/1114, does not constitute by itself a payment service. However, where a crypto-asset service provider offers this service and also provides transfer services for crypto-assets on behalf of clients with electronic money tokens, or payment services included in the scope of Regulation xx [PSR], then the respective services would qualify as payment services. Likewise, transactions where the electronic money tokens are used as collateral for the purpose of conducting transactions with financial instruments do not constitute a payment service. Also, the placing of crypto-assets, as defined in Regulation 2023/1114, does not, in itself, constitute a payment service. Similarly, the exchange of electronic money tokens for funds or crypto-assets by a crypto-asset service provider acting in its own name, as seller or buyer of those electronic money tokens, without intermediating between a buyer and a seller, is not a payment service. Given the market evolution since the adoption of Directive (EU) 2015/2366, and in order to avoid disproportionate requirements for crypto-asset service providers that provide services with electronic money tokens in accordance with Regulation (EU) 2023/1114, and also to ensure legal clarity as regards the scope of application of this Directive and Regulation xx [PSR] to services with electronic money tokens, it is appropriate to exclude from the scope of application of this Directive and Regulation xx [PSR] certain types of payment transactions with electronic money tokens, as specified in Regulation xx [PSR].

(17) The evaluation of the implementation of Directive (EU) 2015/2366 did not identify a clear need to substantially change the conditions for granting and maintaining authorisation as payment institutions or electronic money institutions prescribed under, respectively, Directives 2007/64/EC of the European Parliament and of the Council6 and Directive 2015/2366/EU, on the one hand, and Directive 2009/110/EC on the other hand. Such conditions continue to include prudential requirements proportionate to the operational and financial risks faced by payment institutions, including institutions ▌ providing electronic money services as a payment service in the course of their business. It is appropriate as regards certain payment services to add to the documentation required in support of an application for authorisation as a payment institution a winding-up plan for the eventuality of failure, proportionate to the business model of the future payment institution. That winding-up plan should be appropriate to support an orderly wind-up of activities under applicable national law, including continuity or recovery of any critical activities performed by outsourced service providers, agents or distributors. To avoid that authorisation is granted for services that are not effectively provided by a payment institution, it is necessary to specify that a payment institution should not be obliged to obtain an authorisation for payment services that it does not intend to provide.

(18) The EBA Peer Review on authorisation under Directive (EU) 2015/2366 published in January 20237 concluded that deficiencies in the authorisation process have led to a situation where applicants are subject to different supervisory expectations as regards the requirements for authorisation as a payment institution or electronic money institution across the Union, and that sometimes the process of granting an authorisation may take an exceedingly long time. To ensure a level playing field and a harmonised process for the granting of an authorisation to undertakings applying for a payment institution license, it is appropriate to impose to competent authorities a time limit of 3 months for the authorisation process to be concluded, after the receipt of all the information required for the decision.

(19) To ensure more consistency in the application process for payment institutions, it is appropriate to mandate the EBA to develop draft regulatory technical standards on authorisation, including on the information to be provided to the competent authorities in the application for the authorisation of payment institutions, a common assessment methodology for granting authorisation or for registration, what can be considered as a comparable guarantee to professional indemnity insurance and the criteria to be used to stipulate the minimum monetary amount of professional indemnity insurance or a comparable guarantee. The EBA should therefore take into account the experience acquired in the application of its Guidelines on the information to be provided by applicant payment service providers to national competent authorities for authorisation or registration, and of its Guidelines on the application of the criteria used to specify the minimum monetary amount of the professional indemnity insurance or other comparable guarantee.

(20) The prudential framework applicable to payment institutions should continue to rest on the premise that those institutions are prohibited from accepting deposits from payment service users and are only permitted to use funds received from payment service users for rendering payment services. Consequently, it is appropriate that prudential requirements applicable to payment institutions reflect the fact that payment institutions engage in more specialised and limited activities than credit institutions, thus generating risks that are narrower and easier to monitor and control than those that arise across the broader spectrum of activities of credit institutions.

(21) Competent authorities should pay particular attention in considering applications for authorisation as a payment institution to the governance plan submitted as part of that application. Payment institutions should address the potentially detrimental effect of poorly designed governance arrangements on the sound management of risk by applying a sound risk culture at all levels. Competent authorities should monitor the adequacy of internal governance arrangements. It is appropriate for the EBA to adopt guidelines on internal governance arrangements, taking into account the variation of sizes and business models among payment institutions and respecting the principle of proportionality.

(22) Whilst the authorisation requirements set out specific rules on information and communication technology (ICT) security controls and mitigation elements for obtaining an authorisation to provide payment services, those requirements should be aligned with the requirements under Regulation (EU) 2022/2554 of the European Parliament and of the Council8.

(23) Payment institutions providing only payment initiation services or account information ▌ services ▌ do not hold client funds. Accordingly, it would be disproportionate to impose own funds requirements on those market players. Nevertheless, it is important to ensure that payment initiation service providers and account information service providers are able to meet their liabilities in relation to their activities. In order to ensure a proper coverage of the risks associated with payment initiation or account information services, it is appropriate to require providers offering those services to hold either a professional indemnity insurance or a comparable guarantee, and to further specify what risks need to be covered, in light of the provisions on liability included in Regulation XXX [PSR]. Taking into account the difficulties experienced by the providers of account information services and payment initiation services to contract a professional indemnity insurance covering the risks related to their activity, it is appropriate to provide for the possibility for those providers to choose to hold initial capital or own funds as an alternative to the professional indemnity insurance. Therefore, it is necessary to ensure that the level of own funds or initial capital that is beyond the level required pursuant to this Directive is not excluded from constituting a comparable guarantee, provided that the undertaking provides evidence, to the satisfaction of the relevant competent authority, that it has appropriate safeguards in place to ensure that the respective own funds or initial capital will be available at all times to cover the liabilities specified in this Directive.

(24) To address the risks of acquisition of a qualified holding of a payment institution within the meaning of Regulation (EU) No 575/2013 of the European Parliament and of the Council9, it is appropriate to require notification of the acquisition to the relevant competent authority.

(25) To cater for the risks posed by their activities, payment institutions need to hold enough initial capital combined with own funds. Taking into account the possibility for payment institutions to engage in the wide range of activities covered by this Directive it is appropriate to adjust the level of the initial capital attached to individual services to the nature and the risks attached to these services.

(26) Taking into account that the initial capital requirements applicable to payment institutions have not been adapted since the adoption of Directive 2007/64/EC, it is appropriate to adjust those requirements. In that context, the initial capital applicable to payment institutions that provide only money remittance services should be reviewed and adjusted in order to reflect inflation and to ensure a proportionate alignment with the initial capital requirements applicable to payment institutions that provide other payment services, thereby contributing to the harmonisation of prudential standards and the prevention of regulatory arbitrage. At the same time, given that many money remittance business models are relatively simple and present limited operational and prudential risks, such requirements should remain proportionate and lower than those applicable to payment institutions that provide other payment services, in order to avoid imposing an undue burden on such payment institutions, preserve competition and support financial inclusion. Furthermore, under Directive 2009/110/EC, electronic money institutions were authorised to provide electronic money issuance together with a broader range of payment services, which justified a higher initial capital requirement. Under this Directive, electronic money services should be limited to the issuance of electronic money and classified as a distinct payment service. In light of this narrower scope of activities and the associated risk profile, maintaining a high initial capital requirement would appear disproportionate. It is therefore appropriate to introduce a lower baseline initial capital requirement for electronic money services, aligned more closely with that applicable to other major payment services, while ensuring adequate prudential safeguards as part of the overall regulatory framework. Conversely, taking into account that the initial capital requirements applicable to payment institutions that provide only payment initiation services have only been implemented since the entry into force of Directive (EU) 2015/2366, and that no evidence was found with regard to the inadequacy of those requirements, those requirements should remain unchanged. Where a payment institution provides more than one payment service, a rule for the cumulation of initial capital requirements should apply to that institution.

(27) The large variety of business models in the retail payments industry justifies the possibility to apply distinct methods for the calculation of own funds, which cannot however fall below the level of the relevant initial capital.

(28) This Directive pursues the same approach as Directive (EU) 2015/2366, which allowed for several methods to be used for the purpose of calculating the combined own funds requirements with a certain degree of supervisory discretion to ensure that the same risks are treated the same way for all payment service providers. The use of the payment institution’s payment volume of the previous year to compute its own funds requirements is the most adequate and the most applied own fund calculation method for most business models. For those reasons, and to improve consistency and ensure a level playing field, it is appropriate to require national competent authorities to prescribe the use of that method. It should however be possible for national competent authorities to deviate from that principle and to require payment institutions to apply other methods for business models that result in low volume but high value transactions. To ensure legal certainty and maximum clarity with regard to such business models, it is appropriate to mandate the EBA to develop draft regulatory technical standards.

(29) Notwithstanding the objective of aligning the prudential requirements of payment institutions providing payment services ▌ , it is appropriate to take account of the specificity of the business of issuing electronic money ▌ , and to allow payment institutions that issue electronic money ▌ to apply a more appropriate method to compute their own funds requirements.

(29a) Unlike deposits held with a credit institution, funds of payment service users held with a payment institution are, in the case of insolvency of the payment institution, typically not covered by deposit guarantee schemes or the Union bank recovery and resolution framework. To protect users’ funds in the case of insolvency of the payment institution, payment institutions should, therefore, be required to safeguard users' funds. Payment institutions should be able to meet the requirement to safeguard payment service users’ funds by ensuring that those funds are, as soon as possible after having been received, no longer commingled with the funds of any natural or legal person other than payment service users, or by covering those funds by an insurance policy or some other comparable guarantee from an insurance company or a credit institution authorised in the EU. When the non-commingling option for safeguarding is implemented by a payment institution, it is appropriate to require that payment service users’ funds, which by the end of the business day following the day when they were received by the payment institution have not been delivered by it to the payee, or transferred to the payee’s payment service provider or to an intermediary payment service provider through which funds are transferred to the payee’s payment service provider, be invested in secure, liquid low-risk assets or kept in a separate account with a credit institution or with a central bank. Member States and payment institutions should also ensure that payment service users funds are insulated in accordance with national law in the interest of the payment service users against the claims of other creditors of the payment institution, in particular in the event of insolvency. Insolvency law is not fully harmonised across the Union and procedures that are necessary to ensure that payment service users are seen as secured creditors may vary across Member States. Nevertheless, payment institutions should be able to safeguard payment service users’ funds by depositing them in a separate account in a credit institution or at a central bank in a different Member State than its home Member State. As payment service users of payment institutions are only protected by insolvency law, it may take substantial time to wind up the estate and for the payment service users of an insolvent payment institution to receive their funds. Therefore, payment service users should, prior to entering into an agreement with a payment institution and to any material change in safeguarding measures used, be made aware of the payment institution’s choice of safeguarding measures and the location of the safeguarded funds, as this might directly affect the payment service users’ ability to raise a claim in the case of insolvency of the payment institution. In particular, the payment service user should always be made aware by the payment institution under the insolvency law and courts of which Member State a claim should be raised in the case of insolvency of the payment institution.

(30) Where the same payment institution executes a payment transaction for both the payer and the payee and a credit line is provided to the payer, it is appropriate to safeguard the funds in favour of the payee once they represent the payee’s claim towards the payment institution. International card schemes typically settle funds on a net basis, whereby the repayments and charge-backs are typically deducted from the gross amount received by the payment institution. As a result, a payment institution might receive less funds than the payment institution owes to its payment service users. To ensure that the payment service user’s claims towards the payment institution are protected, the payment institution should always ensure that the safeguarded funds correspond to the claim of the payment service users.

(31) Considering the difficulties experienced by payment institutions in opening and maintaining payment accounts with credit institutions, payment institutions should also be able to safeguard payment service users’ funds by holding those funds in a separate account, that is different from a settlement account, at a central bank. Opening of such an account should however be at the discretion of the central bank ▌ , based on its organic law. Any refusal to open such an account by the central bank is expected to be duly justified to the relevant payment institution.. To ensure a level playing field between payment institutions providing payment services by issuing electronic money and providing other services, it is appropriate to align as much as possible the regimes applicable to the safeguarding of users’ funds, whilst preserving the specificities of electronic money. Furthermore, the requirements in this Directive should be without prejudice to the requirements in Regulation (EU) 2023/1114 regarding the investment of funds received by issuers of electronic money tokens in exchange for electronic money tokens. It is also appropriate to specify that the safeguarding measures in this Directive do not require payment institutions executing payment transactions with electronic money tokens to safeguard the electronic money tokens themselves. Applying the safeguarding methods set out in this Directive to electronic money tokens themselves would be very difficult to achieve in practice and disproportionate. Furthermore, Regulation (EU) 2023/1114 already requires crypto asset service providers to ensure the safekeeping of their clients’ crypto assets, which includes electronic money tokens given the dual nature of these tokens as both crypto assets and funds. That requirement is without prejudice to the application of the safeguarding requirements in this Directive to funds other than electronic money tokens. Concentration risk is a significant risk faced by payment institutions, in particular where payment service users’ funds are safeguarded in a single credit institution. It is therefore important to ensure that, where appropriate, payment institutions avoid concentration risk to the extent possible. For that reason, the EBA should be instructed ▌ to develop regulatory technical standards to specify circumstances in which it is appropriate to avoid concentration risk in the safeguarding of payment service users’ funds.

(31a) Where a payment institution has been granted access to become a direct participant in a payment system designated under Directive 98/26/EC, including a payment system operated by a central bank, funds of payment service users held in a settlement account with such payment system should be considered as safeguarded to meet supervisory requirements provided that those funds are not commingled with the funds of any natural or legal person other than payment service users. This is necessary to ensure that payment institutions providing credit transfer services to their payment service users are able to compete with other payment service providers on equal conditions, including in the context of complying with the requirement to offer the service of sending and receiving instant credit transfers in euro in accordance with the Regulation (EU) 2024/886. Otherwise, those payment institutions would face a competitive disadvantage as they would incur additional costs stemming from the need to obtain either additional funds to ensure, in an efficient manner, sufficient liquidity in the settlement accounts to facilitate uninterrupted processing of outgoing and incoming payments, including instant payments, or insurance of the payment service users’ funds held in the settlement accounts. Moreover, payment institutions’ business models are based on provision of payment services and, therefore, when processing payments, they rely mostly on their client funds. In view of this, payment institutions should be able to use, in a safe manner and without significant additional costs, payment service users’ funds to provide liquidity in their settlement account in a designated payment system. It should be the responsibility of a payment institution to ensure proper management of payment service users’ funds when processing payments in the designated payment system. In cases where a part of an incoming payment transaction to a settlement account represents a fee earned by a payment institution for the services provided to its payment service user, the payment institution should ensure that such fee is separated from the funds of payment service users held in that settlement account without undue delay. To ensure adequate protection of payment service users’ funds, only funds held in settlement accounts with designated payment systems, which are subject to the Regulation (EU) 2025/1355 of the European Central Bank of 2 July 2025 on oversight requirements for systemically important payment systems or to a national framework for the oversight of payment systems based on the Principles for Financial Market Infrastructures of CPSS-IOSCO, should be considered to meet the safeguarding requirements of this Directive. In order to ensure comparability of prudential requirements as regards where payment service users’ funds can be held for the purpose of their safeguarding, i.e. in credit institutions and central banks, such funds, when they are used for settlement of payment transactions, should be considered as safeguarded only in case of designated payment systems where they are ultimately held with credit institutions or central banks. The EBA should develop draft regulatory technical standards specifying the approach for segregation and reconciliation of payment service user funds held in settlement accounts, as part of a broader safeguarding risk management framework. Where deemed necessary for the soundness of monetary policy transmission mechanism or of financial system at large, operators of designated payment systems should be able to set a limit for a maximum amount of funds that can be held by a payment institution in a settlement account, which is sufficient for uninterrupted processing of outgoing and incoming payments, including instant credit transfers. To ensure protection of non-commingled payment service users’ funds held in settlement accounts with designated payment systems in the event of the insolvency of a payment institution, Member States should ensure that those funds are insulated in accordance with national law in the interest of payment service users against the claims of other creditors of the payment institution. Where a payment institution uses an insurance policy or some other comparable guarantee from an insurance company or a credit institution to safeguard the funds of payment service users, it should be able to use both its funds and funds of payment service users in the same settlement account.

(32) It should be possible for payment institutions to engage in other activities, beyond those covered by this Directive, including the provision of operational and closely related ancillary service and the operation of payment systems or other business activities regulated by applicable Union law and national law, such as foreign exchange services, safekeeping activities, storage and processing of data, as well as granting credit under the conditions established in this Directive. It should be noted that those ancillary services are not payment services and their provision on a cross-border basis is subject to the law host Member States may have in place.

(33) Considering the higher risks of deposit-taking activity, it is appropriate to prohibit payment institutions offering payment services from accepting deposits from users, and to require them to only use funds received from users for providing payment services. Funds received from payment service users by payment institutions offering electronic money service should constitute neither a deposit nor other repayable funds received from the public within the meaning of Article 9 of Directive 2013/36/EC of the European Parliament and of the Council.10

(34) To limit the risks of payment accounts being used for other purposes than for the execution of payment transactions, it is appropriate to specify that when engaging in the provision of one or more of the payment services ▌ , payment institutions should always hold payment accounts used exclusively for payment transactions.

(34a) ‘Buy Now Pay Later’ services constitute primarily a consumer credit service subject therefore to EU legislation relating to consumer credit. Nonetheless, undertakings providing ‘Buy Now Pay Later’ services are subject to this Directive if they provide any of the payment services referred to in Annex I.

(35) Payment institutions should be allowed to grant credit, but this activity should be subjected to some strict conditions. It is therefore appropriate to regulate the granting of credit by payment institutions in the form of credit lines and the issuance of credit cards, insofar as those services facilitate payment services and if credit is granted for a period not exceeding 12 months, including on a revolving basis. It is appropriate to allow payment institutions to grant short-term credit with regard to their cross-border activities, on the condition that it is refinanced using mainly the payment institution’s own funds, as well as other funds from the capital markets, and not the funds held on behalf of clients for payment services. That possibility should however be without prejudice to Directive 2008/48/EC of the European Parliament and of the Council11 or other relevant Union law or national measures regarding conditions for granting credit to consumers. Given their principally lending nature, ‘Buy Now Pay Later’ services should not constitute a payment service. Those services are covered by ▌ Directive 2023/2225 on consumer credits replacing Directive 2008/48/EC.

(36) To ensure that evidence on the compliance with the obligations laid down in this Directive is duly preserved for a reasonable amount of time, it is appropriate to require payment institutions to keep all appropriate records for at least five years. Personal data should not be kept longer than necessary for ensuring that purpose and, where an authorisation has been withdrawn, data should not be kept ▌ longer than five years after that withdrawal.

(37) To ensure that an undertaking does not provide payment ▌ services without being authorised, it is appropriate to require all undertakings intending to provide payment ▌ services to apply for an authorisation, except where this Directive provides for registration instead of authorisation. Furthermore, in order to ensure the stability and integrity of the financial system and payment systems and to protect consumers, such undertakings must be established in a Member State and effectively supervised. This requirement should also cover payment institutions issuing electronic money, given the significant new prudential risks associated with the possibility for electronic money institutions to also issue electronic money tokens. The establishment of a legal person in the EU should be required for electronic money issuers to enable effective supervision of those entities, and to align with Regulation 2023/1114/EU. Electronic money tokens are a form of crypto-asset which can scale up significantly in size and pose risks affecting financial stability, monetary sovereignty and monetary policy.

(38) To avoid abuses of the right of establishment and to avoid cases where a payment institution establishes itself in a Member State without planning to perform any activity in that Member State, it is appropriate to require that a payment institution requesting authorisation in a Member State carries out at least part of its payment services business in that Member State. The obligation for an institution to carry out a part of its business in its home country, which was already imposed by Directive (EU) 2015/2366, has been interpreted very differently, with some home countries imposing that most of the business be carried out in their country. A ‘part’ should mean less than the majority of the institution’s business in order to preserve the “effet utile” of the payment institution’s freedom to provide cross-border services.

(39) ▌ To ensure a proper supervision of the payment institution that engages in activities other than the provision of payment services, it is appropriate to allow national competent authorities, where necessary, to require the establishment of a separate entity for the provision of payments ▌ services. Such a decision by the competent authority should take account of the potential negative impact that an event affecting the other business activities could have on the payment institution’s financial soundness, or the potential negative impact arising from a situation where the payment institution would not be able to provide separate reporting on own funds in relation to its payment ▌ activities and its other activities.

(40) To ensure a proper ongoing supervision of payment institutions and the availability of accurate and up-to-date information, it is appropriate to require payment institutions to inform national competent authorities of any change in their business affecting the accuracy of the information provided with regard to authorisation, including with regard to additional agents or entities to which activities are outsourced. Competent authorities should, in the event of doubt, verify that the information received is correct.

(41) To ensure a consistent authorisation regime of payment institutions throughout the Union, it is appropriate to lay out harmonised conditions under which national competent authorities may withdraw an authorisation issued to a payment institution.

(42) To enhance transparency of the operations of payment institutions that are authorised by, or registered with, competent authorities of the home Member State, including their agents ▌ and branches, and to ensure a high level of consumer protection in the Union, it is necessary to ensure easy public access to the list of the undertakings providing payment services, with their related brands, which should be included in a public national register.

(43) To ensure that information on authorised or registered payment institutions or entities entitled under national law to provide payment ▌ services is available throughout the Union in a central register, the EBA should operate such a register in which it should publish a list of the names of the undertakings authorised or registered to provide payment services ▌ . Where that entails the processing of personal data, the publication at Union level of information on natural persons acting as agents ▌ is necessary to guarantee that only authorised agents ▌ operate in the internal market and is therefore in the interest of the adequate functioning of the internal market for payment services. Member States should ensure that the data that they provide on the undertakings concerned, including their agents ▌ and branches, is accurate and up-to-date, and transmitted to the EBA without undue delay and if possible in an automated way. The EBA should therefore develop draft regulatory technical standards to specify the methods and arrangements for the transmission of such information. Those draft regulatory technical standards should ensure a high level of granularity and consistency of the information. When developing those draft regulatory technical standards, the EBA should take into consideration the experience in applying Commission Delegated Regulation (EU) 2019/411.12 To enhance transparency, it is appropriate that the information transmitted contains the brands of all payment ▌ services provided. Publication of personal data should occur in compliance with the rules on data protection in force. Where personal data are published, appropriate data protection safeguards that prevent further unintended dissemination of the information online should be implemented.

(44) To enhance transparency and awareness of the services provided by payment initiation and account information service providers, it is appropriate that the EBA maintains a machine-readable list containing basic information on such undertakings and services provided by them. The information contained in this list should allow for the payment initiation and account information service providers to be identified unequivocally.

(45) To expand the reach of their services, payment institutions may need to use entities providing payment services on their behalf, including agents ▌ . Payment institutions may also exercise their right of establishment in a host Member State, different from the home Member State, through branches. In such cases, it is appropriate that the payment institution communicates to the national competent authority all the relevant information related to agents ▌ and branches and informs national competent authorities of any changes without undue delay. To ensure transparency vis-à-vis end users, it is also appropriate that agents, persons distributing or redeeming electronic money on behalf of a payment institution, and branches acting on behalf of a payment institution, inform payment service users of that fact. Moreover, in order to be considered as an agent, it should not be sufficient for a given entity merely to participate in the provision of a payment service or merely to carry out some client-facing activities. Only a natural or legal person acting in the name and on behalf of a payment institution in providing payment services that enters into possession of the funds on behalf of the payment institution or is directly involved in the payment institution’s provision of payment services should be considered as an agent of a payment institution. In order to ensure clarity and trust in the provision of payment services via agents, it is essential that customers are made aware of the identity of the payment service provider whose services they are obtaining through the agent. Further, payment institutions issuing electronic money should be allowed to distribute and redeem electronic money via persons acting on their behalf, without such distribution or redemption constituting a payment service. Those persons might involve other natural or legal persons. Neither those persons nor the other parties they involve should be deemed as agents unless they are providing payment services. The distribution of electronic money should also cover the receipt, in exchange for electronic money, of funds from the holder acquiring the electronic money. Where a person distributing electronic money acting on behalf of payment institutions receives, in exchange for electronic money, funds from a holder acquiring the electronic money, those funds should be considered to have been received by the payment institution itself, considering that this person is acting on behalf of the payment institution. The payment institution remains ultimately liable for those persons in the distribution or redemption of electronic money, for compliance with AML/CFT requirements, as regards those activities carried out via those persons, and for ensuring that policies, procedures and internal controls with regard to such distributors comply with Regulation (EU) 2024/1624. Where a payment institution that issues electronic money makes use of an agent, that agent should not itself issue electronic money. The issuance of electronic money should only be carried out by the payment institution authorised to issue electronic money.

(46) In conducting their business, payment institutions might need to outsource operational functions ▌ . To ensure that this is not done to the detriment of the continuing compliance of a payment institution with the requirements of its authorisation, or other applicable requirements under this Directive, it is appropriate to require a payment institution to inform without undue delay national competent authorities when it intends to outsource operational functions, and about any change regarding the use of entities to which activities are outsourced.

(47) To ensure a proper mitigation of the risks that the outsourcing of operational functions might generate, it is appropriate to require that payment institutions take reasonable steps to ensure that such outsourcing does not violate the requirements of this Directive. Payment institutions should remain fully liable for any acts of their employees, or any agent ▌ or outsourced entity.

(48) To ensure the effective enforcement of the provisions of national law adopted pursuant to this Directive, Member States should designate competent authorities in charge of the authorisation and supervision of payment institutions, and the investigation of unauthorised payment services. Member States should ensure that competent authorities are granted all powers and resources necessary, including staff, to properly carry out their functions.

(49) The powers bestowed upon the competent authorities should include the power to intervene against unauthorised payment services, including the power to investigate alleged infringements, in particular of the authorisation requirement, to order the immediate cessation of business operations and the immediate full settlement of already concluded activities, and to investigate infringements of Regulation XXX (PSR) and of this Directive. To enable competent authorities to effectively enforce the authorisation requirement and to properly supervise payment institutions, it is appropriate to grant those authorities investigatory and supervisory powers and the possibility to impose or initiate administrative or legal proceedings to impose penalties and measures necessary to perform their tasks. For the same reason, it is appropriate to grant competent authorities the power to request information, conduct on-site inspections, search business premises as well as private home estate, ancillary facilities, movables and persons and to issue recommendations, guidelines and binding administrative decisions. Member States should lay down national provisions, harmonised under the provisions of this Directive, with respect to the suspension or withdrawal of the authorisation of a payment institution. Member States should empower their competent authorities to impose administrative sanctions and measures aimed specifically at ending infringements of provisions concerning the supervision or pursuit of the payment service business.

(50) Due to the broad range of possible business models in the payments industry, it is appropriate to allow for a certain degree of supervisory discretion to ensure that the same risks are treated in the same way across all Member States.

(51) When supervising compliance by payment institutions with their obligations, competent authorities should exercise their supervisory powers respecting fundamental rights, including the right to privacy. Without prejudice to the control of an independent authority (national data protection authority) and in accordance with the Charter of Fundamental Rights of the European Union, Member States should have in place adequate and effective safeguards where there is a risk that the exercise of those powers could lead to abuse or arbitrariness amounting to serious interference with such rights including, where appropriate, through the prior authorisation of the judicial authority of the Member State concerned.

(52) To ensure the protection of individual and business rights, Member States should ensure that all persons who work or who have worked for competent authorities are subjected to the obligation of professional secrecy.

(53) The activity of certain payment institutions crosses borders and is relevant for different competent authorities as well as the EBA, the European Central Bank (‘ECB’) and national central banks in their capacity as monetary and oversight authorities. It is therefore appropriate to provide for their effective cooperation and exchange of information. Information sharing arrangements should fully comply with the data protection rules laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council13 and in Regulation (EU) 2018/1725 of the European Parliament and of the Council.14

(54) Where disagreements occur in the context of the cross-border cooperation between competent authorities, those competent authorities should be able to request assistance from the EBA, which should take a decision without undue delay. The EBA should also be able to assist competent authorities in reaching an agreement on its own initiative.

(55) A payment institution that exercises the right of establishment or freedom to provide services should provide the competent authority of the home Member State with any relevant information with regard to its business and notify that competent authority about which Member State(s) the payment institution intends to operate in, whether it intends to use branches or agents ▌ and whether it intends to use outsourcing. Where a payment institution intends to distribute or redeem electronic money in another Member State through a natural or legal person, a corresponding notification, adapted to the specificities of such persons, should also apply. While such natural or legal persons distributing or redeeming electronic money are not subject to registration requirements under this Directive, it is nevertheless appropriate to ensure that information relating to such cross-border activities is communicated by the payment institution to the competent authorities of the home Member State and transmitted to the competent authorities of the host Member States in the context of the home-host cooperation.

(56) To facilitate cooperation between competent authorities and an effective supervision of payment institutions, in the context of the use of the right of establishment or freedom to provide services, it is appropriate that competent authorities in the home Member State communicate information to the host Member State. In situations of so-called “triangular passporting” where a payment institution authorised in a country “A” uses an intermediary, such as an agent ▌ or branch, located in a country “B” for offering payment services in another country “C”, the host Member State should be considered to be the one where the services are offered to end-users. Taking into account challenges in cross-border cooperation between competent authorities, it is appropriate that the EBA develops draft regulatory technical standards on cooperation and information exchange, taking into consideration the experience gained in applying Commission Delegated Regulation (EU) 2017/2055.15

(57) Member States should be able to require payment institutions operating on their territory, whose head office is situated in another Member State, to report to them periodically on their activities in their territory for information or statistical purposes. Where those payment institutions operate pursuant to the right of establishment, the competent authorities of the host Member State(s) should be able to require that information also to be used for monitoring compliance with Regulation XXX [PSR]. The same should apply where there is no establishment in the host Member State(s), and the payment institution is providing services in the host Member State(s) on the basis of the free provision of services. To facilitate the supervision of networks of agents ▌ or branches by competent authorities, it is appropriate that Member States where agents ▌ or branches operate are able to require the parent payment institution to appoint a central contact point in their territory. Where a Member State does impose such a requirement, each payment institution should appoint only one central contact point per Member State. The EBA should develop regulatory technical standards setting out the criteria to determine when the appointment of a central contact point is appropriate and what its functions should be ▌ . The requirement to appoint a central contact point should be proportionate to achieving the aim of adequate communication and information reporting on compliance with the relevant provisions in Regulation XXX [PSR] in the host Member State.

(58) In emergency situations, where immediate action is necessary to address a serious threat to the collective interests of payment service users in the host Member State, including large scale fraud, it should be possible for the competent authorities of the host Member State to take precautionary measures in parallel with the cross-border cooperation between competent authorities of the host and the home Member States and pending measures by the competent authority of the home Member State. Those measures should be appropriate, proportionate to the aim, non-discriminatory and temporary in nature. Any measures should be properly justified. The competent authorities of the home Member State of the relevant payment institution and other authorities concerned, including the Commission and the EBA, should be informed in advance or, where not possible in view of the emergency situation, without undue delay.

(59) It is important to ensure that all entities providing payment services be brought within the scope of certain minimum legal and regulatory requirements. Thus, it is desirable to require the registration of the identity and whereabouts of all persons providing payment services, including of entities which are unable to meet the full range of conditions for authorisation as payment institutions, including some small payment institutions. Such an approach is in line with the rationale of Recommendation 14 of the Financial Action Task Force, which provides for a mechanism whereby payment service providers which are unable to meet all of the conditions set out in that Recommendation may nevertheless be treated as payment institutions. For those purposes, even where entities are exempt from all or part of the conditions for authorisation, Member States should enter them in the register of payment institutions. However, it is essential to make the possibility of an exemption from authorisation subject to strict requirements relating to the value of payment transactions. Entities benefiting from an exemption from authorisation should not enjoy the right of establishment or freedom to provide services and should not indirectly exercise those rights while being a participant in a payment system.

(60) To ensure transparency with regard to possible exemptions for small payment institutions, it is appropriate to require Member States to communicate such decisions to the Commission.

(61) In view of the specific nature of the activity performed and the risks connected to the provision of account information services, it is appropriate to provide for a specific prudential regime for account information service providers, without a need for a fully-fledged authorisation regime but with a lighter registration requirement, accompanied by documents and information to assist the competent authority with carrying out supervision. Account information service providers should be allowed to provide services on a cross-border basis, benefiting from the ‘passporting’ rules.

(62) To further improve access to cash, which is a priority of the Commission, retailers should be allowed to offer, in physical shops, cash provision services even in the absence of a purchase by a customer, without having to obtain a payment service provider authorisation, registration or being an agent of a payment institution. Those cash provision services should, however, be subject to the obligation to disclose fees charged to the customer, if any. Those services should be provided by retailers on a voluntary basis and should depend on the availability of cash by the retailer. To prevent unfair competition between ATM deployers not servicing payment accounts and retailers offering cash withdrawals without a purchase, and to ensure that shops do not rapidly run out of cash, it is appropriate to impose a maximum cap of EUR 150 per withdrawal or the equivalent in national currency. The payment transaction through which retailers provide cash services should be subject to strong customer authentication. Member States should also be able to adopt a lower limit, no lower than EUR 100, taking into account national specificities, such as the level of cash availability in a Member State and specific national AML risks. Moreover, to prevent the abuse of the set transaction limit and to ensure an adequate level of protection against money laundering and countering terrorist financing risks, Member States should be able to provide that cash provision services in retail stores are also subject to a daily withdrawal limit, per payment account. The account servicing payment service provider of the payer should be responsible for implementing the set limits.

(63) Directives 2007/64/EC and 2015/2366/EU conditionally excluded from their scope payment services offered by certain deployers of automated teller machines (ATMs). That exclusion has stimulated the growth of ATM services in many Member States, in particular in less populated areas, supplementing bank ATMs. However, this exclusion has proven difficult to apply due to its ambiguity with regard to the entities covered by it. To address this issue, it is appropriate to make explicit that previously excluded ATM deployers are those which do not service payment accounts and whose activities do not constitute any of the licensed services listed in Annex I, particularly service (1). Taking into account the limited risks involved in the activity of such ATM deployers, it is appropriate, instead of excluding them totally from the scope, to subject them to a ▌ registration regime tailored to the specific risks they present. Furthermore, to ensure proper implementation, registration might be refused or revoked if competent authorities consider that an ATM deployer does not comply with the requirements set out in this Directive. In such cases, competent authorities should inform the concerned ATM deployer justifying their decision.

(64) Service providers seeking to benefit from an exclusion from the scope of Directive (EU) 2015/2366 often did not consult their authorities on whether their activities are covered by, or excluded from, that Directive, but often relied on their own assessments. That has led to a divergent application of certain exclusions across Member States. It also appears that some exclusions may have been used by payment service providers to redesign business models so that the payment activities offered would fall outside the scope of that Directive. That may result in increased risks for payment service users and divergent conditions for payment service providers in the internal market. Service providers should therefore be obliged to notify relevant activities to competent authorities so that the competent authorities can assess whether the requirements set out in the relevant provisions are fulfilled and to ensure a homogenous interpretation of the rules throughout the internal market. In particular, for all exclusions based on the respect of a threshold, a notification procedure should be provided to ensure compliance with the specific requirements. Moreover, it is important to include a requirement for potential payment service providers to notify competent authorities of the activities that they provide in the framework of a limited network on the basis of the criteria set out in Regulation XXX [PSR] where the value of payment transactions exceeds a certain threshold. Competent authorities should assess whether the activities so notified can be considered to be activities provided in the framework of a limited network, to ascertain whether they should remain excluded from the scope.

(65) The power to adopt acts in accordance with Article 290 of the Treaty on the Functioning of the European Union should be delegated to the Commission in respect of updating any of the amounts to take account of inflation. The Commission, when preparing and drawing-up delegated acts, should ensure a simultaneous, timely and appropriate transmission of relevant documents to the European Parliament and to the Council.

(66) To ensure a consistent application of the applicable requirements, the Commission should be able to rely on the expertise and support of the EBA, which should be given the task of preparing guidelines and draft regulatory technical standards. The Commission should be empowered to adopt those draft regulatory technical standards. Those specific tasks are fully in line with the role and responsibilities of the EBA as provided in Regulation (EU) No 1093/2010 of the European Parliament and of the Council18.

(67) Since the further integration of an internal market in payment services, cannot be sufficiently achieved by the Member States alone because it requires the harmonisation of different rules currently existing in the legal systems of the various Member States which would be better achieved at Union level, the Union may adopt measures, in accordance with the principle of subsidiarity as set out in Article 5 of the Treaty on European Union. In accordance with the principle of proportionality, as set out in that Article, this Directive does not go beyond what is necessary in order to achieve that objective.

(68) This Directive does not include licensing requirements for payment systems, payment schemes or payment arrangements, taking into account the need to avoid any duplication with the Eurosystem’s oversight framework over retail payment systems, including over Systemically Important Payment Systems and other systems, as well as the Eurosystem’s new ‘PISA’ Framework, and oversight by national central banks. This Directive also does not cover, in its scope, the provision of technical services including processing or the operation of digital wallets. However, considering the pace of innovation in the payments sector and the possible emergence of new risks, it is necessary that in its future review of this Directive the Commission gives particular consideration to those developments and assesses whether the scope of the Directive should be extended to cover new services and entities.

(69) In the interest of legal certainty, it is appropriate to make transitional arrangements allowing undertakings who have commenced the activities of payment institutions in accordance with the national law transposing Directive (EU) 2015/2366 before the entry into force of this Directive to continue those activities within the Member State concerned for a specified period.

(70) In the interest of legal certainty, transitional arrangements should be made to ensure that electronic money institutions which have taken up their activities in accordance with the national laws transposing Directive 2009/110/EC are able to continue those activities within the Member State concerned for a specified period. That period should be longer for electronic money institutions that have benefited from the waiver provided for in Article 9 of Directive 2009/110/EC.

▌

(74) In keeping with the principles of better regulation, this Directive should be reviewed for its effectiveness and efficiency in achieving its objectives, as laid out in the accompanying impact assessment. The review should take place a sufficient time after the entry into force ▌ to base the review on appropriate evidence. Seven years is considered to be an appropriate period. While the review should consider the entire Directive, certain topics should be singled out for particular attention, namely the ▌ safeguarding of payment institutions funds, and the number and market share of payment service providers authorised under this Directive, which may be affected by ▌ the rules proposed by the Commission on 18 April 20231 which, when adopted, would amend Directive 2014/49/EU of the European Parliament and of the Council of 16 April 2014 on deposit guarantee schemes. Regarding the scope of this Directive, however, it is appropriate for a review to take place earlier, three years after the entry into force of Regulation (EU) [.../...] of the European Parliament and of the Council2 (Payment Services Regulation), given the importance attached to this subject in Regulation (EU) 2022/2554. That review of scope should consider both the possible extension of the list of covered payment services to include services such as those performed by payment systems and payment schemes, and the possible inclusion in the scope of some technical services currently excluded such as digital wallets.

(75) Given the number of changes that need to be made to Directive (EU) 2015/2366 and Directive 2009/110/EC, it is appropriate to repeal both Directives and replace them by this Directive.

(76) Any personal data processing in the context of this Directive must comply with Regulation (EU) 2016/679 and Regulation (EU) 2018/1725. Therefore, the supervisory authorities under Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 are responsible for the supervision of processing of personal data carried out in the context of this Directive. When transposing this Directive, the Member States should ensure that the national legislation include appropriate data protection safeguards for processing of personal data.

(77) The European Data Protection Supervisor was consulted in accordance with Article 42(1) of Regulation (EU) 2018/1725 and delivered an opinion on 22 August 2023.

HAVE ADOPTED THIS DIRECTIVE:

TITLE I SUBJECT MATTER, SCOPE AND DEFINITIONS

Article 1 Subject matter and scope

1. This Directive lays down rules concerning:

(a) access to the activity of providing payment ▌ services, within the Union, by payment institutions;

(b) supervisory powers and tools for the supervision of payment institutions.

2. Member States may exempt the institutions referred to in Article 2(5), points (4) to (23), of Directive 2013/36/EU from the application of all or part of the provisions of this Directive.

▌

3. This Directive does not apply to services set out in Article 2(2) of the Regulation XXX [PSR], with the exception of Articles 37 and 39 of this Directive.

Article 2 Definitions

For the purposes of this Directive, the following definitions apply:

(1) ‘home Member State’ means either of the following:

(a) the Member State in which the payment service provider has its registered office; or

(b) if the payment service provider has, under its national law, no registered office, the Member State in which the payment service provider has its head office;

(2) ‘host Member State’ means the Member State other than the home Member State in which a payment service provider has an agent ▌ or a branch or provides payment services;

(3) ‘payment service’ means any business activity set out in Annex I;

(4) ‘payment institution’ means a legal person that has been granted authorisation in accordance with Article 13 to provide payment services ▌ throughout the Union;

(5) ‘payment transaction’ means ▌ a payment transaction as defined in Article 3, point (5), of Regulation XXX [PSR];

(6) ‘execution of a payment transaction’ means the process starting once the initiation of a payment transaction is completed and ending once the funds placed, withdrawn, or transferred are available to the payee;

(7) ‘payment system’ means a payment system as defined in Article 3, point (9), of Regulation XXX [PSR];

(8) ‘payment system operator’ means ▌ a payment system operator as defined in Article 3, point (10), of Regulation XXX [PSR];

(9) ‘payer’ means a payer as defined in Article 3, point (11), of Regulation XXX [PSR];

(10) ‘payee’ means a payee as defined in Article 3, point (12), of Regulation XXX [PSR] ;

(11) ‘payment service user’ means a ▌ payment service user as defined in Article 3, point (13), of Regulation XXX [PSR];

(12) ‘payment service provider’ means a payment service provider as defined in Article 3, point (14), of Regulation XXX [PSR] ▌ ;

(13) ‘payment account’ means ▌ a payment account as defined in Article 3, point (15), of Regulation XXX [PSR];

(14) ‘payment order’ means ▌ a payment order as defined in Article 3, point (16), of Regulation XXX [PSR];

(15) ‘payment instrument’ means ▌ a payment instrument as defined in Article 3, point (18), of Regulation XXX [PSR];

(16) ‘account servicing payment service provider’ means an account servicing payment service provider’ as defined in Article 3, point (19), of Regulation XXX [PSR];

(17) ‘payment initiation service’ means a ▌ payment initiation service as defined in Article 3, point (20), of Regulation XXX [PSR];

(18) ‘account information service’ means an account information ▌ service as defined in Article 3, point (21), of Regulation XXX [PSR];

(19) ‘payment initiation service provider’ means a payment initiation service provider as defined in Article 3, point (22), of Regulation XXX [PSR];

(20) ‘account information service provider’ means an account information service provider as defined in Article 3, point (23), of Regulation XXX [PSR];

(21) ‘consumer’ means a consumer as defined in Article 3, point (24), of Regulation XXX [PSR];

(22) ‘money remittance’ means a payment service where funds are received from a payer, without any payment accounts being created in the name of the payer or the payee, for the sole purpose of transferring a corresponding amount to a payee or to another payment service provider acting on behalf of the payee, or where such funds are received on behalf of and made available to the payee;

(23) ‘funds’ means funds as defined in Article 3, point (30), of Regulation XXX [PSR] ;

(24) ‘technical service provider’ means a technical service provider as defined in Article 3, point (36), of Regulation XXX [PSR];

(25) ‘sensitive payment data’ means sensitive payment data as defined in Article 3, point (38), of Regulation XXX [PSR];

(26) ‘business day’ means a ▌ business day as defined in Article 3, point (43), of Regulation XXX [PSR]

(27) ‘Information and communications technology (ICT) services’ means ICT Services as defined in Article 3, point (21), of Regulation (EU) 2022/2554;

(28) ‘agent’ means a natural or legal person who acts in the name and on behalf of a payment institution in providing payment services, and who either enters into possession of funds on behalf of the payment institution or is directly involved in the payment institution's provision of payment services;

(29) ‘branch’ means a place of business other than the head office which is a part of a payment institution, which has no legal personality and which carries out directly some or all of the transactions inherent in the business of a payment institution; all of the places of business set up in the same Member State by a payment institution with a head office in another Member State shall be regarded as a single branch;

(30) ‘group’ means a group of undertakings that are linked to each other by a relationship as referred to in Article 22(1), ▌ (2) or (7) of Directive 2013/34/EU of the European Parliament and of the Council19, or undertakings as referred to in Articles 4, 5, 6 and 7 of Commission Delegated Regulation (EU) No 241/201420, which are linked to each other by a relationship as referred to in Article 10(1) or Article 113(6), first subparagraph, or 113(7), first subparagraph of Regulation (EU) No 575/2013;

(31) ‘acquiring of payment transactions’ means a payment service as defined in Article 3, point (48), of Regulation XXX [PSR];

(32) ‘issuing of payment instruments’ means issuing of payment instruments as defined in Article 3, point (49), of Regulation XXX [PSR];

(33) ‘own funds’ means funds as defined in Article 4(1), point 118, of Regulation (EU) No 575/2013 where at least 75 % of the Tier 1 capital is in the form of Common Equity Tier 1 capital as referred to in Article 50 of that Regulation and Tier 2 capital is equal to or less than one third of Tier 1 capital;

(34) ‘electronic money’ means electronic money as defined in Article 3(50) [PSR];

(35) ‘average outstanding electronic money’ means the average total amount of financial liabilities related to electronic money in issue at the end of each calendar day over the preceding six calendar months, calculated on the first calendar day of each calendar month and applied for that calendar month;

▌

(38) ‘ATM deployer’ means a natural or legal person providing cash withdrawal services as referred to in Annex I, point (1), and which is not an account servicing payment service provider and does not provide any other payment services referred to in Annex I;

▌

(39b) ‘applicant payment institution’ means an undertaking which has applied for authorisation based on Article 3 and of which the decision is still pending;

(42) ‘electronic money token’ means an electronic money token as defined in Article 3(1), point (7), of Regulation (EU) 2023/1114.

TITLE II PAYMENT INSTITUTIONS

CHAPTER I Licensing and supervision

Section 1 General ▌ rules

Article 3 Applications for authorisation

1. Member States shall require undertakings other than the undertakings referred to in Article 2(1), points (a), (b), (d), and (e), of Regulation XXX [PSR], and other than natural or legal persons benefiting from an exemption pursuant to Articles 34, 36, 37 and 38 of this Directive, that intend to provide any of the payment services referred to in Annex I, ▌ to obtain authorisation from the competent authorities of the home Member Sate for the provision of those services.

2. The authorisation referred to in paragraph 1 shall only be required for those payment services that the applicant payment institutions actually intend to provide.

3. Member States shall ensure that undertakings that apply for an authorisation as referred to in paragraph 1 provide the competent authorities of the home Member State with an application for authorisation, together with the following:

(a) a programme of operations setting out in particular the type of payment services envisaged;

(b) a business plan including a forecast budget calculation for the first 3 financial years which demonstrates that the applicant is able to employ the appropriate and proportionate systems, resources and procedures to operate soundly;

(c) evidence that the applicant holds initial capital as provided for in Article 5;

(d) for the undertakings applying to provide services as referred to in Annex I, points (1) to (5), and (8) a description of the measures taken for safeguarding payment service users’ funds in accordance with Article 9;

(e) a description of the applicant’s governance arrangements and internal control mechanisms, including administrative, risk management and accounting procedures, and a description of the applicant’s arrangements for the use of ICT services as referred to in Articles 6 and 7 of Regulation (EU) 2022/2554, which demonstrates that those governance arrangements, internal control mechanisms and arrangements for the use of ICT services are proportionate, appropriate, sound and adequate;

(f) a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including a description of the incident reporting mechanism which takes account of the notification obligations of the payment institution laid down in Chapter III of Regulation (EU) 2022/ 2554;

(g) a description of the process in place to file, monitor, track and restrict access to sensitive payment data;

(h) a description of business continuity arrangements including a clear identification of the critical operations, a description of the ICT business continuity plans and ICT response and recovery plans, and a description of the procedure to regularly test and review the adequacy and efficiency of such ICT business continuity and ICT response and recovery plans, as required by Article 11(6) of Regulation (EU) 2022/2554;

▌

(j) a security policy document, including:

(i) a detailed risk assessment in relation to the applicant’s payment ▌ services;

(ii) a description of security control and mitigation measures to adequately protect payment service users against the risks identified, including fraud and the illegal use of sensitive and personal data;

▌

(k) for applicant payment institutions ▌ subject to the obligations in relation to money laundering and terrorist financing under [Regulation (EU) 2024/1624 of the European Parliament and of the Council] and [Regulation (EU) 2023/1113 of the European Parliament and of the Council], a description of the internal control mechanisms which the applicant payment institution has established to comply with those Regulations;

(l) a description of the applicant payment institution’s structural organisation, including, where applicable, a description of:

(i) the intended use of agents ▌ or branches;

(ii) the off-site and on-site checks that the applicant undertakes to perform on those agents ▌ or branches at least annually;

(iii) a description of outsourcing arrangements;

(iv) the applicant’s participation in a national or international payment system;

(m) the identity of the persons that hold in the applicant, directly or indirectly, qualifying holdings within the meaning of Article 4(1), point (36), of Regulation (EU) No 575/2013, the size of their holdings and evidence of their suitability to ensure the sound and prudent management of the applicant;

(n) the identity of directors and other persons responsible for the management of the applicant payment institution and, where relevant:

(i) the identity of the persons responsible for the management of the payment services activities of the payment institution;

(ii) evidence that the persons responsible for the management of the payment services activities of the payment institution are of good repute and possess appropriate knowledge and experience to perform payment services as determined by the home Member State of the applicant;

(o) where applicable, the identity of the statutory auditors and audit firms as defined in Article 2, points 2 and 3, of Directive 2006/43/EC of the European Parliament and of the Council21;

(p) the applicant’s legal status and articles of association;

(q) the address of the applicant’s registered office;

(r) an overview of EU jurisdictions where the applicant payment institution is submitting or is planning to submit an application for authorisation to operate as a payment institution, or where other entities belonging to the same group as the applicant payment institution have submitted such an application in the past three years. Where the applicant payment institution or any other entity belonging to the same group has submitted an application within the last three years, the decision of the relevant competent authority granting or refusing such authorisation, and, if applicable, the main reasons for refusal.

(s) for applicants that intend to provide payment services as referred to in Annex I, points (1) to (5), or point (8), a winding-up plan in case of failure, which is adapted to the envisaged size and business model of the applicant, including the return of safeguarded funds in the event of a disorderly wind-up.

For the purposes of the first subparagraph, points (d), (e), (f) and (l), Member States shall ensure that the applicant provides a description of its audit arrangements and of the organisational arrangements it has set up to protect the interests of its users and to ensure continuity and reliability in the performance of payment ▌ services.

The security control and mitigation measures referred to in the first subparagraph, point (j), shall indicate how the applicant will ensure a high level of digital operational resilience as required by Chapter II of Regulation (EU) 2022/2554, in particular in relation to technical security and data protection, including for the software and ICT systems used by the applicant or the undertakings to which it outsources its operations.

3a. Notwithstanding paragraph 3, Member States shall ensure that undertakings that have been authorised as crypto-asset service provider in accordance with Article 63 of Regulation (EU) 2023/1114 [MiCA] and that apply for an authorisation as referred to in paragraph 1 provide the competent authorities of the home Member State with an application for authorisation, together with the following:

(a) the information and documentation required under Article 3(3), points (e), (k), (o), (p), (q) and (r), in the form in which it has been previously submitted in the licensing process pursuant to Article 62 of Regulation (EU) 2023/1114; in the event that parts of this information and documentation are no longer up-to-date, the undertaking shall provide the information and documentation in updated form indicating the documents in which changes have been made;

(b) a programme of operations pursuant to Article 3(3), point (a), and a business plan and forecast budget calculation pursuant to Article 3(3), point (b), that builds on the information handed in pursuant to Article 62(2), point (d), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged;

(c) evidence that the undertaking holds initial capital as provided for in Article 5 pursuant to Article 3(3), point (c);

(d) a description of the procedure in place to monitor, handle and follow up a security incident and security related customer complaints, including a description of the incident reporting mechanism which takes account of the notification obligations of the payment institution laid down in Chapter III of Regulation (EU) 2022/2554 pursuant to Article 3(3), point (f); that description shall build on the information handed in pursuant to Article 62(2), point (i), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged;

(e) a description of the process in place to file, monitor, track and restrict access to sensitive payment data according to Article 3(3), point (g);

(f) a description of business continuity arrangements including a clear identification of the critical operations, a description of the ICT business continuity plans and ICT response and recovery plans, and a description of the procedure to regularly test and review the adequacy and efficiency of such ICT business continuity and ICT response and recovery plans, as required by Article 11(6) of Regulation (EU) 2022/2554 pursuant to Article 3(3), point (h); those descriptions shall build on the information submitted pursuant to Article 62(2), point (j), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged;

▌

(h) the security policy document pursuant to Article 3(3), point (j), concerning the payment services envisaged;

(i) a description of the undertaking’s structural organisation according to Article 3(3), point (l), that builds on the information submitted pursuant to Article 62(2), points (d) and (f), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged;

(j) information according to Article 3(3), points (m) and (n), that builds on the information handed in according to Article 62(2), points (g) and (h), of Regulation (EU) 2023/1114, amended by the information according to the additional provision of payment services envisaged, containing a clear statement that the information provided under Regulation (EU) 2023/1114 is still up-to-date;

(k) a winding-up plan in case of failure, which is adapted to the envisaged size and business model of the undertaking, pursuant to Article 3(3), point (s);

(l) if applicable to the intended payment service the information pursuant to Article 3(3), point (d), and Article 3(4).

4. Member States shall require undertakings that apply for authorisation to provide payment services as referred to in Annex I, point (6), as a condition of their authorisation, to hold a professional indemnity insurance, covering the territories in which they offer services, or some other comparable guarantee, and that they ensure that:

(a) they can cover their liabilities as specified in Articles 56, 57, 59, 76, and 78 of Regulation XXX [PSR];

(b) they cover the value of any excess, threshold or deductible from the insurance cover or comparable guarantee;

(c) they monitor the coverage of the insurance or comparable guarantee on an ongoing basis.

For the purpose of the first subparagraph, the professional indemnity insurance or the other comparable guarantee shall be in place at the moment when the applicant starts providing payment services.

5. The EBA shall develop draft regulatory technical standards specifying:

(a) the information to be provided to the competent authorities in the application for the authorisation of payment institutions and for the registration of account information service providers, including the requirements laid down in paragraph 3, points (a), (b), (c), (e), (f) and (g) to (k), (r) and (s), and in paragraph 3a;

(aa) the information to be provided to the competent authorities in the registration of ATM deployers, including the requirements laid down in paragraph 3, points (a), (b), (e) to (h), (j) to (l), (n), (p) and (q);

(b) a common assessment methodology for granting authorisation of payment institutions, and for registration of account information service providers or ATM deployers, under this Directive;

(c) what is a comparable guarantee, as referred in paragraph 4 of this Article and in Article 36(4), first subparagraph, that could be considered inter-changeable with a professional indemnity insurance;

(d) the criteria on how to stipulate the minimum monetary amount of the professional indemnity insurance and other comparable guarantee as referred in paragraph 4 of this Article and Article 36(4).

For the purposes of point (c), the own funds or initial capital of an undertaking referred to in paragraph 4 that are beyond the level required pursuant to this Directive or of an account information service provider referred to in Article 36(1) shall not be excluded from what a comparable guarantee is, provided that theundertaking or the account information service provider provides evidence, to the satisfaction of the relevant competent authority, that it has appropriate safeguards in place to ensure that the respective own funds or initial capital will be available at all times, including in the event of insolvency, in order to meet the liabilities referred to in paragraph 4 of this Article or Article 36(4), respectively.

6. When developing those draft regulatory technical standards referred to in paragraph 5, the EBA shall take account of the following:

(a) the risk profile of the undertaking;

(b) whether the undertaking provides other payment services as referred to in Annex I or is engaged in other businesses;

(c) the size of the activity of the undertaking;

(d) the specific characteristics of comparable guarantees, as referred in paragraph 4, and the criteria for their implementation.

The EBA shall submit those draft regulatory technical standards referred to in paragraph 5 to the Commission by [ OP please insert the date= 1 year after the date of entry into force of this Directive].

Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.

Article 4 Control of the shareholding

1. Any natural or legal person who has taken a decision to acquire or to further increase, directly or indirectly, a qualifying holding within the meaning of Article 4(1), point (36), of Regulation (EU) No 575/2013 in a payment institution, as a result of which the proportion of the capital or of the voting rights held would reach or exceed 20 %, 30 % or 50 %, or so that the payment institution would become its subsidiary, shall inform the competent authorities of that payment institution in writing of their intention in advance. The same applies to any natural or legal person who has taken a decision to dispose, directly or indirectly, of a qualifying holding, or to reduce its qualifying holding so that the proportion of the capital or of the voting rights held would fall below 20 %, 30 % or 50 %, or so that the payment institution would cease to be its subsidiary.

2. The proposed acquirer of a qualifying holding in the payment institution shall inform the competent authority about the size of the intended holding and relevant necessary information as referred to in Article 23(4) of Directive 2013/36/EU.

3. Member States shall require that where the influence exercised by a proposed acquirer, as referred to in paragraph 1, is likely to operate to the detriment of the prudent and sound management of the payment institution, the competent authorities shall express their opposition or take other appropriate measures to bring that situation to an end. Such measures may include injunctions, penalties against directors or the persons responsible for the management of the payment institution in question, or the suspension of the exercise of the voting rights attached to the shares held by the shareholders or members of this payment institution.

Similar measures shall apply to natural or legal persons who fail to comply with the ▌ obligation to provide prior information, as laid down in paragraph 2.

4. Where a holding as referred to in paragraph 1 is acquired despite the opposition of the competent authorities, Member States shall, regardless of any other penalty to be adopted, provide for the exercise of the corresponding voting rights to be suspended, the nullity of votes cast or the possibility of annulling those votes.

Article 5 Initial capital

Member States shall require payment institutions to hold, at the time of authorisation, initial capital, comprised of one or more of the items referred to in Article 26, points (1)(a) to (e), of Regulation (EU) No 575/2013 as follows:

(a) where the payment institution provides only the payment service referred to in Annex I, point (5), its capital shall at no time be less than EUR 40 000;

(b) where the payment institution provides the payment service referred to in Annex I, point (6), its capital shall at no time be less than EUR 50 000;

(c) without prejudice to point (a), where the payment institution provides any of the payment services referred to in Annex I, points (1) to (5), its capital shall at no time be less than EUR 150 000;

(d) where the payment institution provides payment service referred to in Annex I, point (8), its capital shall at no time be less than EUR 250 000.

Where the payment institution provides payment services referred to in more than one of points (b), (c) and (d), the minimum amounts shall be added together.

Article 6 Own funds

1. Member States shall require that the payment institution’s own funds do not fall below the amount of initial capital referred to in Article 5, or the amount of own funds either calculated in accordance with Article 7 for payment institutions that do not issue electronic money ▌ , or calculated in accordance with Article 8 for payment institutions that issue electronic money ▌ , whichever is the higher.

2. Member States shall take the necessary measures to prevent the multiple use of elements eligible for own funds where the payment institution belongs to the same group as another payment institution, credit institution, investment firm, asset management company or insurance undertaking. The same shall also apply where a payment institution has a hybrid character and carries out activities other than providing payment ▌ services.

3. Where the conditions laid down in Article 7 of Regulation (EU) No 575/2013 are met, Member States or their competent authorities may choose not to apply Articles 7 or 8 of this Directive, as applicable, to payment institutions which are included in the consolidated supervision of the parent credit institution pursuant to Directive 2013/36/EU.

Article 7 Calculation of own funds for payment institutions that do not issue electronic money ▌

1. Notwithstanding the initial capital requirements set out in Article 5, Member States shall require payment institutions, other than payment institutions that either only offer payment initiation services as referred to in Annex I, point (6), or only offer account information services as referred to in Annex I, point (7), or only both such services, and other than payment institutions that issue electronic money as referred to in Annex I, point (8), to hold own funds calculated in accordance with paragraph 2 at all times.

2. Competent authorities shall require payment institutions to apply, by default, method B as laid down in point b) below. Competent authorities may however decide that, in light of their specific business model, in particular where they only execute a small number of transactions but of a high individual value, payment institutions shall rather apply method A or C. For the purposes of methods A, B and C, the preceding year is to be understood as the ▌ 12-month period prior to the moment of calculation.

(a) Method A

The payment institution’s own funds shall amount to at least 10 % of its fixed overheads of the preceding year. The competent authorities may adjust that requirement in the event of a material change in a payment institution’s business since the preceding year. Where a payment institution has not completed a full year’s business at the date of the calculation, payment institution’s own funds shall amount to at least 10 % of the corresponding fixed overheads as projected in its business plan, unless the competent authorities have required an adjustment to that plan.

(b) Method B

The payment institution’s own funds shall amount to at least the sum of the following elements multiplied by the scaling factor k referred to in paragraph 3, where payment volume (PV) represents one twelfth of the total amount of payment transactions executed by the payment institution in the preceding year:

(i) 4,0 % of the slice of PV up to EUR 5 million;

plus

(ii) 2,5 % of the slice of PV above EUR 5 million up to EUR 10 million;

plus

(iii) 1 % of the slice of PV above EUR 10 million up to EUR 100 million;

plus

(iv) 0,5 % of the slice of PV above EUR 100 million up to EUR 250 million;

plus

(v) 0,25 % of the slice of PV above EUR 250 million.

Where a payment institution has not completed a 12-month period of operation at the date of the calculation, the PV may be based on the total amount of payment transactions as projected in its business plan, unless the competent authority has required an adjustment to that plan.

(c) Method C

The payment institution’s own funds shall amount to at least the relevant indicator referred to in point (i), multiplied by the multiplication factor referred to in point (ii) and by the scaling factor k referred to in paragraph 3.

(i) The relevant indicator shall be the sum of the following:

(1) interest income;

(2) interest expenses;

(3) commissions and fees received; and

(4) other operating income.

Each element shall be included in the sum with its positive or negative sign. Income from extraordinary or irregular items shall not be used in the calculation of the relevant indicator. Expenditure on the outsourcing of services rendered by third parties may reduce the relevant indicator where the expenditure is incurred from an undertaking subject to supervision under this Directive. The relevant indicator shall be calculated on the basis of the 12-monthly observation at the end of the previous financial year. The relevant indicator shall be calculated over the previous financial year.

Own funds calculated in accordance with method C shall not fall below 80 % of the average of the previous 3 financial years for the relevant indicator. When audited figures are not available, business estimates may be used.

(ii) The multiplication factor shall be:

(1) 10 % of the slice of the relevant indicator up to EUR 2,5 million;

(2) 8 % of the slice of the relevant indicator from EUR 2,5 million up to EUR 5 million;

(3) 6 % of the slice of the relevant indicator from EUR 5 million up to EUR 25 million;

(4) 3 % of the slice of the relevant indicator from EUR 25 million up to 50 million;

(5) 1,5 % above EUR 50 million.

3. The scaling factor k to be used in methods B and C shall be:

(a) 0,5 where the payment institution provides only the payment service as referred to in point (5) of Annex I;

(b) 1 where the payment institution provides any of the payment services as referred to in any of points (1) to (4) of Annex I.

4. Member States shall require that payment institutions other than payment institutions that either only offer payment initiation services as referred to in Annex I, point (6), or only offer account information services as referred to in Annex I, point (7), or only both such services, and other than payment institutions that only issue electronic money as referred to in Annex I, point (8), that also engage in the activities referred to in Article 10, ensure that the own funds held for the services listed in Annex I, points (1) to (5), are not considered as own funds held for the purpose of Article 10, paragraph 4, point (d) or other services not regulated under this Directive.

5. Competent authorities may, based on an evaluation of the risk-management processes, risk loss data base and internal control mechanisms of the payment institution, require the payment institution to hold an amount of own funds which is up to 20 % higher than the amount which would result from the application of the method chosen in accordance with paragraph 2. Competent authorities may permit the payment institution to hold an amount of own funds which is up to 20 % lower than the amount which would result from the application of the method to be applied in accordance with paragraph 2.

6. The EBA shall develop draft regulatory standards in accordance with Article 16 of Regulation (EU) No 1093/2010 concerning the criteria to determine when the payment institution’s business model is such that they only execute a small number of transactions, but of a high individual value, as referred in paragraph 2 of this Article.

The EBA shall submit those draft regulatory technical standards to the Commission by [ ▌ OP please insert the date = 1 year after the date of entry into force of this Directive].

Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.

Article 8 Calculation of own funds for payment institutions that issue electronic money ▌

1. Notwithstanding the initial capital requirements set out in Article 5, Member States shall require payment institutions offering both the payment services referred to in point (8) of Annex I and any payment services referred to in points (1) to (5) of Annex I, to hold, at all times, own funds calculated in accordance with Article 7 for the provision of payment services referred to in points (1) to (5) of Annex I.

2. Notwithstanding the initial capital requirements set out in Article 5, Member States shall require payment institutions that only offer the payment service referred to in point (8) of Annex 1 to hold, at all times, own funds calculated in accordance with Method D as set out in paragraph 3.

3. Method D: The own funds ▌ shall amount to at least 2 % of the average outstanding electronic money.

4. Member States shall require that payment institutions that both issue electronic money as referred to point (8) of Annex I and offer payment services as referred to in Annex I, points (1) to (5), hold at all times own funds that are at least equal to the sum of the requirements referred to in paragraphs 1 and 2 of this Article.

5. Member States shall allow payment institutions that both issue electronic money as referred to in point (8) of Annex I and

(a) offer any of the payment services referred to in points (1) to (5) of Annex I, where those payment services are not linked to the issuance of electronic money referred to in point (8) of Annex 1, or

(b) offer any of the activities referred to in Article 10(1) and (4), ▌

to calculate their own funds requirements on the basis of a representative portion assumed to be used for the issuance of electronic money referred to in point (8) of Annex 1, provided that such a representative portion can be reasonably estimated on the basis of historical data and to the satisfaction of the competent authorities, where the amount of outstanding electronic money is unknown in advance. Where a payment institution providing the payment service referred to in point (8) of Annex 1 has not completed a sufficient period of business, its own funds requirements shall be calculated on the basis of projected outstanding electronic money evidenced by its business plan subject to any adjustment to that plan required by the competent authorities.

▌

Article 9 Safeguarding requirements

1. Member States shall require a payment institution which provides payment services as referred to in Annex I, points (1) to (5), or point (8), to safeguard all funds other than electronic money tokens it has received from payment service users or through another payment service provider for the execution of payment transactions, or where applicable the funds received in exchange for electronic money that has been issued, in one or more of the following ways:

(a) the payment institution shall ensure that those funds as soon as possible are no longer commingled ▌ with the funds of any natural or legal person other than the payment service users on whose behalf the funds are held;

(b) those funds shall be covered by an insurance policy or some other comparable guarantee from an insurance company or a credit institution authorised in a Member State, which does not belong to the same group as the payment institution itself, for an amount equivalent to the amount that would have been segregated in the absence of the insurance policy or other comparable guarantee, payable in the event that the payment institution is unable to meet its financial obligations.

For the purposes of the first subparagraph, point (a), where the payment institution still holds the funds and has not yet by the end of the business day following the day when the funds have been received, delivered those funds to the payee or transferred those funds to another payment service provider in order to complete the transfer of the funds to the payee, the payment institution shall do either of the following:

(a) deposit those funds either in a separate account in a credit institution authorised in a Member State, or at a central bank at the discretion of that central bank;

(b) invest those funds in secure, liquid low-risk assets, as determined by the competent authorities of the home Member State;

For the purposes of the first subparagraph, point (a), Member States and payment institutions shall ensure that those funds are insulated in accordance with national law in the interest of the payment service users against the claims of other creditors of the payment institution, in particular in the event of insolvency.

By way of derogation from the second subparagraph, point (a), Member States may allow payment institutions to deposit those funds in a separate account in a post office giro institution referred to in Article 2, paragraph 1, point (b), of [Regulation XXX (PSR)], provided that that post office giro institution is established in a Member State and is supervised and subject to prudential requirements comparable to those applied to credit institutions.

For the purposes of the first subparagraph, payment institutions shall ensure that they safeguard the amount that corresponds to the claim against the payment institution of the payment service user arising from the provision of payment services.

Payment institutions shall inform their payment service users in a clear and transparent manner how funds of the individual user are safeguarded, the insolvency law of which Member State is applicable, and in which Member State a claim is to be raised in the event of the insolvency of the payment institution.

By way of derogation from subparagraph 1, and without prejudice to paragraph 4 of this Article, where a payment institution issues electronic money tokens, it shall safeguard the funds received in exchange for the electronic money tokens in accordance with the methods set out in Article 54 of Regulation (EU) 2023/1114.

1a. Funds of payment service users held by a payment institution in settlement accounts with payment systems designated under the Directive 98/26/EC shall be considered as compliant with the requirements set out in paragraph 1 if those funds are not commingled with the funds of any natural or legal person other than payment service users. Member States shall ensure, without prejudice to requirements of Directive 98/26/EC, that funds of payment service users held in settlement accounts with payment systems are insulated in accordance with national law in the interest of payment service users against the claims of other creditors of the payment institution, in particular in the event of its insolvency.

The first subparagraph shall apply only to those payment systems where the funds used for settlement are ultimately held in credit institutions or central banks.

2. Where payment institutions use the safeguarding method set out in paragraph 1, first subparagraph, point (a), they shall avoid, where appropriate, concentration risk to safeguarded payment service users' funds. In particular, they shall endeavour not to safeguard all payment service users' funds with one credit institution.

3. Where a payment institution is required to safeguard funds under paragraph 1 and a portion of those funds is to be used for future payment transactions with the remaining amount to be used for services other than payment services, that portion of the funds to be used for future payment transactions shall also be subject to the requirements of paragraph 1. Where that portion is variable or not known in advance, Member States shall allow payment institutions to apply this paragraph on the basis of a representative portion assumed to be used for payment services, provided that such a representative portion can be reasonably estimated on the basis of historical data to the satisfaction of the competent authorities.

4. ▌Funds received for the purpose of issuing electronic money need not be safeguarded until the funds are credited to the payment institution’s payment account or are otherwise made available to the payment institution in accordance with the execution time requirements laid down in Regulation XXX [PSR]. In any event, such funds shall be safeguarded by no later than the end of the business day following the day when the funds have been received, after the issuance of electronic money.

A payment institution issuing electronic money shall ensure that holders of that electronic money, both the payment service user having exchanged funds for electronic money and the beneficiary of a payment transaction in electronic money, are always entitled to redemption at par value and upon request, through the issuing payment institution.

5. ▌For the purpose of application of paragraph 1, secure, liquid, low-risk assets are asset items falling into one of the categories set out in Table 1 of Article 336(1) of Regulation (EU) No 575/2013 for which the specific risk capital charge is no higher than 1,6 %, but excluding other qualifying items as defined in Article 336(4) of that Regulation.

For the purposes of paragraph 1, secure, liquid, low-risk assets are also units in an undertaking for collective investment in transferable securities (UCITS) which invests solely in assets as specified in the first subparagraph.

In exceptional circumstances and with a proper justification, the competent authorities may, based on an evaluation of security, maturity, value or other risk elements of the assets as specified in the first and second subparagraphs, determine which of those assets shall not be considered as secure, low-risk assets for the purposes of paragraph 1.

6. A payment institution shall inform the competent authorities in advance of any material change in measures taken for safeguarding of funds received for payment services provided and in case of the payment service referred to in Annex I, point (8), in exchange for electronic money issued.

7. The EBA shall develop regulatory technical standards on safeguarding requirements, laying down in particular safeguarding risk management frameworks for payment institutions to ensure protection of users’ funds, and including requirements on segregation, designation, reconciliation and calculation of safeguarded funds. They shall in particular specify the circumstances in which it is appropriate to avoid concentration risks as referred to in paragraph 2 of this Article, taking into account the principle of proportionality, and requirements on segregation and reconciliation of payment service users' funds held in settlement accounts pursuant to paragraph 1a of this Article.

The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 1 year after the date of entry into force of this Directive].

Power is delegated to the Commission to adopt the regulatory technical standards referred to in the first subparagraph in accordance with Articles 10 to 14 of Regulation (EU) No 1093/2010.

Article 10 Activities

1. In addition to the provision of payment ▌ services, payment institutions shall be entitled to engage in the following activities:

(a) the provision of operational and closely related ancillary services, including ▌ , foreign exchange services, safekeeping activities, and the storage and processing of data;

(b) the operation of payment systems;

(c) business activities other than the provision of payment services ▌ , having regard to applicable Union and national law.

2. For the purpose of providing payment services, payment institutions shall hold, or maintain for its payment service users, only payment accounts which are used exclusively for payment transactions.

3. Any funds received by payment institutions from payment service users to provide payment ▌ services shall not constitute a deposit or other repayable funds within the meaning of Article 9 of Directive 2013/36/EU.

4. Payment institutions may grant credit relating to the payment services referred to in Annex I, points (2) to (4), subject to the following conditions ▌ :

(a) the credit is ancillary to, and granted exclusively in connection with, the execution of a payment transaction;

(b) notwithstanding national rules, if any, on providing credit by issuers of credit cards, the credit granted in connection with a payment and executed in accordance with Article 13(6) and Article 30 is to be repaid within a reasonably short period, which shall in no case exceed 12 months;

(c) the credit granted does not come from the funds received or held for executing a payment transaction or from the funds which have been received from payment services users in exchange for electronic money and held in accordance with Article 9, paragraphs 1 and 1a;

(d) the own funds of the payment institution are at all times and to the satisfaction of the supervisory authorities appropriate in view of the overall amount of credit granted.

5. Payment institutions shall not take deposits or other repayable funds within the meaning of Article 9 of Directive 2013/36/EU.

6. Payment institutions that issue electronic money ▌ shall exchange any funds, including cash or scriptural money, received by that payment institution from payment service users for electronic money without delay. Such funds shall neither constitute a deposit, nor other repayable funds received from the public within the meaning of Article 9 of Directive 2013/36/EC.

7. This Directive shall be without prejudice to Directive 2008/48/EC, other relevant Union law or national measures regarding conditions for granting credit to consumers not harmonised by this Directive that comply with Union law.

Article 11 Accounting and statutory audit

1. Council Directive 86/635/EEC22, Directive 2013/34/EU and Regulation (EC) No 1606/2002 of the European Parliament and of the Council23, shall apply to payment institutions mutatis mutandis.

2. Unless exempted under Directive 2013/34/EU and, where applicable, Directive 86/635/EEC, the annual accounts and consolidated accounts of payment institutions shall be audited by statutory auditors or audit firms as defined in Article 2, points 2 and 3, of Directive 2006/43/EC.

3. For supervisory purposes, Member States shall require that payment institutions provide separate accounting information for, on the one hand, payment ▌ services, and, on the other hand, the activities referred to in Article 10(1), which shall be subject to an auditor’s report. That report shall be prepared, where applicable, by the statutory auditors or an audit firm.

4. The obligations laid down in Article 63 of Directive 2013/36/EU shall apply mutatis mutandis to the statutory auditors or audit firms of payment institutions in respect of payment services ▌ .

Article 12 Record-keeping

Member States shall require payment institutions to keep all appropriate records for the purpose of this Title for at least 5 years, without prejudice to Directive (EU) 2015/849 or other relevant Union law. When such records include personal data, the payment institution shall not keep those records for longer than necessary for the purpose of this Title. Where there is a withdrawal of the authorisation of the payment institution in accordance with Article 16, records that include personal data shall not be kept more than 5 years after the authorisation has been withdrawn.

Article 13 Granting of authorisation

1. Member States shall authorise an applicant payment institution for the payment services ▌ it intends to provide, provided that the applicant payment institution:

(a) is a legal person established in a Member State;

(b) has submitted to its competent authorities the information referred to in Article 3(3) or Article 3(3a) respectively;

(c) has taken into account the need to ensure the sound and prudent management of the applicant payment institution, robust governance arrangements for the payment services ▌ it intends to provide, including:

(i) a clear organisational structure with well-defined, transparent and consistent lines of responsibility;

(ii) effective procedures to identify, manage, monitor and report the risks to which the applicant payment institution is or might be exposed;

(iii) adequate internal control mechanisms, including sound administration and accounting procedures.

(d) has the initial capital referred to in Article 5;

(e) complies with Article 3(4).

The governance arrangements and control mechanisms referred to in point (c) shall be comprehensive and proportionate to the nature, scale and complexity of the payment services ▌ the applicant payment institutions intend to provide.

By [OP please insert the date: one year after the date of entry into force of this Directive], the EBA shall adopt guidelines, in accordance with Article 16 of Regulation (EU) No 1093/2010, addressed to the competent authorities designated under this Directive, on the arrangements, processes and mechanisms referred to in this paragraph.

2. Competent authorities of the home Member State shall grant an authorisation if the information and evidence accompanying the application complies with all of the requirements laid down in Article 3 and if the competent authorities’ overall assessment, having scrutinised the application, is favourable. Before granting an authorisation, the competent authorities may, where relevant, consult the national central bank or other relevant public authorities.

2a. Without prejudice to paragraph 2, competent authorities of the home Member State shall decide on the authorisation within 60 business days where a crypto-asset service provider that has been authorised as crypto-asset service provider in accordance with Article 63 of Regulation (EU) 2023/1114 intends to provide payment services only with electronic money tokens.

The period as set out in first subparagraph shall commence upon receipt by the competent authority of the home Member State of the application and the information to be submitted pursuant to Article 3(3a).

Where the competent authority concludes that an application is not complete, it shall immediately inform the applicant crypto-asset provider thereof, specifying the missing or incomplete information, and set a deadline by which that applicant is required to provide the missing information.

The period as set out in the first subparagraph shall be suspended until the information is provided or on the expiry of that deadline, whichever comes sooner. The competent authority may, in accordance with the procedure described above, continue to request any missing or incomplete information until the application is complete.

If an authorisation is granted, it shall be limited to the provision of services specified in the application.

3. A payment institution which, under the national law of its home Member State, is required to have a registered office, shall have its head office in the same Member State as its registered office and shall carry out a part of its payment service ▌ business there. The competent authorities of the Member State where the payment institution is to have its registered office shall however not require the payment institution to carry out the majority of its business in the country where it will have its registered office.

4. Competent authorities may, as a condition for authorisation, require that the applicant payment institution establishes a separate entity for the provision of the payment services referred to in Annex I, points (1) to (6) and (8), where the applicant payment institution is engaged in other business activities that may impair, or is likely to impair, either the financial soundness of the applicant payment institution or the ability of the competent authorities to monitor the applicant payment institution’s compliance with this Directive.

5. Competent authorities shall refuse to authorise an applicant payment institution in any of the following cases:

(a) where, taking into account the need to ensure the sound and prudent management of the payment institution, those competent authorities are not satisfied as to the suitability of the shareholders or members that have qualified holdings;

(b) where there are close links as defined in Article 4(1), point (38), of Regulation (EU) No 575/2013 between the payment institution and natural or legal persons that do prevent the effective exercise of the supervisory functions of the competent authorities;

(c) where the laws, regulations, or administrative provisions of a third country governing one or more natural or legal persons with which the payment institution has close links as defined in Article 4(1), point (38), of Regulation (EU) No 575/2013, or difficulties involved in the enforcement of those laws, regulations or administrative provisions, prevent the effective exercise of the supervisory functions of the competent authorities.

6. An authorisation shall be valid in all Member States and shall allow the payment institution concerned to provide the payment ▌ services that are covered by the authorisation throughout the Union, pursuant to the freedom to provide services or the freedom of establishment.

Article 14 Communication of the decision to authorise or refuse authorisation

Within 3 months of receipt of an application for authorisation as referred to in Article 3, or, where such application is incomplete, of all of the information referred to in Article 3(3) required for the decision, the competent authorities shall inform the applicant whether the authorisation is granted or refused. The competent authority shall give reasons where it refuses an authorisation.

Article 15 Maintenance of the authorisation as a payment institution

Member States shall require payment institutions to, without undue delay, inform their competent authority of any change in the information and evidence provided in accordance with Article 3 which may affect the accuracy of that information or evidence.

Article 16 Withdrawal of the authorisation as a payment institution

1. Competent authorities of the home Member State may withdraw an authorisation issued to a payment institution only where:

(a) the payment institution has not made use of its authorisation within 12 months after it has obtained that authorisation, or has not provided any of the services for which it has been authorised for more than six successive months;

(b) the payment institution has explicitly renounced that authorisation;

(c) the payment institution no longer meets the conditions for granting the authorisation or fails to inform the competent authority on major developments in this respect;

(d) the payment institution has obtained the authorisation based on false statements or any other irregular means;

(e) the payment institution has breached its obligations in terms of money laundering or terrorist financing prevention under Directive (EU) 2015/849;

(f) the continued provision of the payment services ▌ by the payment institution would threaten the stability of, or the trust in, the payment system;

(g) the payment institution falls within one of the cases where national law provides for such withdrawal.

2. The competent authority shall give reasons for any withdrawal of an authorisation and shall inform those concerned accordingly.

3. The competent authority shall make public the withdrawal of an authorisation, including in the registers or lists referred to in Articles 17 and 18.

Article 17 Register of payment institutions in the home Member State

1. Member States shall operate and maintain, free of charge, a public electronic register of payment institutions, including entities registered in accordance with Articles 34, 36, 38, and of their agents ▌ . Member States shall ensure this register contains all of the following information ▌

(a) payment institutions authorised in accordance with Article 13 and their agents ▌ , if any;

(b) natural and legal persons registered in accordance with Articles 34(2), 36(1) or 38(1) and their agents ▌ , if any;

(c) the institutions referred to in Article 1(2) that are entitled under national law to provide payment ▌ services.

Branches of payment institutions shall be entered in the register of the home Member State if those branches provide services in a Member State other than their home Member State.

2. The public register referred to in paragraph 1 shall:

(a) identify the payment ▌ services and the respective brands for which the payment institution has been authorised, or for which the natural or legal person has been registered;

(b) include the agents ▌ through which the payment institution provides payment ▌ services ▌ , and specify the services these agents ▌ carry out on behalf of the payment institution;

(c) include the other Member States where the payment institution is active and indicate the date when these passported activities started.

3. Member States shall ensure that payment institutions are listed in the register referred to in paragraph 1 separately from natural and legal persons registered in accordance with Articles 34, 36 or 38, and that that register is publicly available for consultation, accessible online, and updated without delay.

4. Competent authorities shall enter in the public register dates of authorisation or registration, any withdrawal of authorisation, suspension of authorisation, and any withdrawal of a registration pursuant to Articles 34, 36 or 38.

5. Competent authorities shall notify the EBA without any undue delay of the reasons for the withdrawal of the authorisation or registration, suspension of authorisation or registration, or of any exemptions pursuant to Article 34, 36 or 38.

Article 18 EBA register

1. The EBA shall operate and maintain an electronic central register of payment institutions, including entities registered in accordance with Articles 34, 36 and 38, and their agents ▌ and branches where applicable. That electronic central register shall contain the information as notified by the competent authorities in accordance with paragraph 3. The EBA shall be responsible for the accurate presentation of that information.

2. The EBA shall make the electronic central register publicly available on its website, and shall allow for easy access to and easy search for the information listed, free of charge.

3. Competent authorities shall provide the EBA with the information entered in their national public registers in accordance with Article 17 at the latest within one business day after they entered that information in the national public registers.

4. Competent authorities shall be responsible for the accuracy of the information contained in their national registers and provided to the EBA, and for keeping that information up to date. Companies listed in the Register shall be given means to correct any inaccuracies concerning themselves.

5. The EBA shall develop draft regulatory technical standards on the operation and maintenance of the electronic central register referred to in paragraph 1 and on access to the information contained therein to ensure that only the competent authority concerned or the EBA may modify the information contained in the register.

The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Directive].

Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.

6. The EBA shall develop draft implementing technical standards on the details and structure of the information to be notified pursuant to paragraph 1, including the data standards and formats for the information, as set out in Commission Implementing Regulation (EU) 2019/41024.

The EBA shall submit those draft implementing technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Directive].

Power is delegated to the Commission to adopt the implementing technical standards referred to in the first subparagraph in accordance with Article 15 of Regulation (EU) No 1093/2010.

7. The EBA shall develop, operate and maintain a central, machine-readable list of the payment service providers offering the payment services listed in Annex I, points 6 and 7, based on the most recent information contained in the EBA register referred to in paragraph 1 and on the EBA Credit Institution Register created pursuant to Article 8(2), point (j) of Regulation (EU) No 1093/2010. That list shall contain the name and identifier of those payment services providers and their authorisation status.

▌

Section 2 Use of agents ▌ , branches and outsourcing

Article 19 Use of agents

1. Payment institutions that intend to provide payment services through agents shall communicate to the competent authorities in their home Member State all of the following information:

(a) the name, and where applicable, the legal name, the address of the agent and the address(es) from which the agent offers payment services;

(b) an up-to-date description of the internal control mechanisms that the agent will use to comply with Directive (EU) 2015/849;

(c) the identity of directors and the other persons responsible for the management of the agent and, where the agent is not a payment service provider, evidence that those persons are fit and proper for their tasks;

(d) the payment services provided by the payment institution for which the agent is mandated;

(e) where applicable, the unique identification code or number of the agent;

(ea) a clear description of the proposed business model of the agent;

(eb) the address of the website of the agent where the agent offers payment services through a website;

(ec) for legal persons, proof of incorporation of the legal entity;

(ed) an overview of the flow of funds and operational processing of the intended payment transactions.

2. Member States shall ensure that the competent authorities of the home Member State communicate to the payment institution within six weeks of receipt of the information referred to in paragraph 1 whether the agent has been entered in the register referred to in Article 17. Upon entry in the register, the agent may commence providing payment services.

3. Before listing the agent in the register referred to in Article 17, the competent authorities shall, where they consider that the information referred to in paragraph 1 is incorrect, take further action to verify the information.

4. Where, after having verified the information referred to in paragraph 1, the competent authorities are not satisfied that that information is correct, they shall refuse to list the agent in the register referred to in Article 17 and shall inform the payment institution thereof without undue delay.

5. Member States shall ensure that payment institutions that wish to provide payment services in another Member State by engaging an agent, or that intend to provide payment services in a Member State other than its home Member State via an agent located in a third Member State, follow the procedures set out in Article 30.

6. Member States shall ensure that payment institutions inform their payment service users of the fact that an agent is acting on their behalf.

7. Member States shall ensure that payment institutions communicate to the competent authorities of their home Member State any change regarding the use of agents, including about additional agents, without undue delay and in accordance with the procedure provided for in paragraphs 2, 3 and 4.

7a. Where the payment institution wishes to distribute or redeem electronic money in another Member State through a natural or legal person, Articles 29 to 33, with the exception of Article 30(1), point (e), and Article 31(4)-(7) of this Directive, shall apply mutatis mutandis to such payment institution.

For the purposes of complying with Article 30(1), point (d), payment institutions shall not be required to provide the information referred to in paragraph 1, points (c), (ec) and (ed) of this Article, regarding such a natural or legal person.

7b. ▌Payment institutions shall not issue electronic money through agents.

▌

Article 21 Branches

1. Member States shall ensure that payment institutions that intend to provide payment services in another Member State by establishing a branch, or that intend to provide payment services in a Member State other than their home Member State via a branch located in a third Member State, follow the procedures set out in Article 30.

2. Member States shall ensure that payment institutions require the branches that act on their behalf to inform payment service users of this fact.

Article 22 Entities to which activities are outsourced

1. Member States shall ensure that payment institutions that intend to outsource operational functions of payment ▌ services inform the competent authorities of their home Member State thereof.

Without prejudice to Regulation 2022/2554, Member States shall ensure that payment institutions do not outsource important operational functions ▌ in such a way that the quality of the payment institution’s internal control and the ability of the competent authorities to monitor and retrace the payment institution’s compliance with all of the obligations laid down in this Directive is materially impaired.

An operational function shall be important where a defect or failure in its performance would materially impair the continuing compliance of a payment institution with the requirements of its authorisation, its other obligations under this Directive, its financial performance, or the soundness or the continuity of its payment ▌ services.

Member States shall ensure that when payment institutions outsource important operational functions, they shall meet all of the following conditions:

(a) the outsourcing does not result in the delegation by senior management of its responsibility;

(b) the relationship and obligations of the payment institution towards its payment service users under this Directive is not altered;

(c) the conditions with which the payment institution is to comply to be authorised and remain so is not undermined;

(d) none of the other conditions subject to which the payment institution’s authorisation was granted is removed or modified.

2. Member States shall ensure that payment institutions communicate without undue delay to the competent authorities of their home Member State any change regarding the use of entities to which activities are outsourced.

Article 23 Liability

1. Member States shall ensure that payment institutions that rely on third parties for the performance of operational functions take reasonable steps to ensure that the requirements of this Directive are complied with.

2. Member States shall require that payment institutions remain fully liable for any acts of their employees, or any agent, ▌ branch or entity to which activities are outsourced or that acts on behalf of the payment institution.

Section 3 Competent authorities and supervision

Article 24 Designation of competent authorities

1. Member States shall designate as the competent authorities responsible for the authorisation and prudential supervision of payment institutions which are to carry out the duties provided for under this Title either public authorities, or bodies recognised by national law or by public authorities expressly empowered for that purpose by national law, including national central banks. Member States shall not designate payment institutions, credit institutions, or post office giro institutions as competent authorities.

The competent authorities shall be independent from economic bodies and avoid conflicts of interest.

Member States shall provide the Commission with the name and the contact details of the competent authority designated in accordance with the first subparagraph.

2. Member States shall ensure that the competent authorities designated under paragraph 1 possess all powers necessary for the performance of their duties.

Member States shall ensure that competent authorities have the necessary resources, notably in terms of dedicated staff, to exercise their tasks.

3. Member States that have appointed more than one competent authority for matters covered by this Title ▌ shall ensure that those authorities cooperate closely to discharge their respective duties effectively.

4. The tasks of the competent authorities designated under paragraph 1 shall be the responsibility of the competent authorities of the home Member State.

5. Paragraph 1 shall not imply that the competent authorities are required to supervise business activities of the payment institutions other than the provision of payment services and the activities referred to in Article 10(1), point (a).

Article 25 Supervision

1. Member States shall ensure that the controls exercised by the competent authorities for ensuring continued compliance with this Title are proportionate, adequate and responsive to the risks to which payment institutions are exposed.

To ensure compliance with this Title, the competent authorities shall, in particular, be entitled to take the following steps:

(a) require the payment institution to provide any information needed to monitor compliance specifying the purpose of the request, as appropriate, and the time limit by which the information is to be provided;

(b) carry out on-site inspections at the business premises of the payment institution, of any agent ▌ or branch providing payment ▌ services under the responsibility of the payment institution, or at the business premises of any entity to which activities are outsourced or that acts on behalf of the payment institution;

(c) issue recommendations, guidelines and, if applicable, binding administrative provisions;

(d) ▌ suspend or ▌ withdraw an authorisation pursuant to Article 16;

(e) require payment institutions to have own funds in excess of the requirements set out in Articles 7, 8 or 10(4)(d), or to adjust the own funds required in case of material changes in the business of those payment institutions;

(f) require the reinforcement of the arrangements, processes, mechanisms and strategies implemented in accordance with point (c) of Article 13(1);

(g) restrict or limit the business, operations or network of payment institutions or request the divestment of activities that pose excessive risks to the financial soundness of a payment institution;

(h) require the reduction of the risk inherent in the activities, products and systems of payment institutions, including outsourced activities;

(i) restrict or prohibit distributions or interest payments by a payment institution to shareholders, members or holders of own funds instruments;

(j) require payment institutions to establish a separate entity for the provision of non-payment services activities, where the payment institutions are engaged in other business activities that may impair, or are likely to impair, either the financial soundness of the payment institution or the ability of the competent authorities to monitor the payment institution’s compliance with this Directive;

(k) impose administrative sanctions and administrative measures in accordance with paragraph 2 and with national law;

(l) require payment institutions to remove persons responsible for the management of the payment institution when they fail to comply with the requirements set out in Article 3(3), point (n) (ii).

2. Without prejudice to Article 16 and any national provisions of criminal law, Member States shall provide that their competent authorities may impose or initiate administrative or legal proceedings to impose penalties and measures aimed specifically at ending observed infringements, and removing the causes of such infringements, upon payment institutions or those who effectively control the business of payment institutions which breach the provisions transposing this Directive.

3. Notwithstanding the requirements of Article 5, Article 6(1) and (2), Article 7, and Article 8, Member States shall ensure that the competent authorities can take the steps referred to in paragraph 1 of this Article to ensure sufficient capital for payment institutions, in particular where activities other than payment services ▌ impair or are likely to impair the financial soundness of the latter.

Article 26 Professional secrecy

1. Without prejudice to cases covered by national criminal law, Member States shall ensure that all persons who work or who have worked for the competent authorities, and any experts acting on behalf of the competent authorities, are bound by the obligation of professional secrecy.

2. The information exchanged in accordance with Article 28 shall be subject to the obligation of professional secrecy by both the sharing and recipient authority to ensure the protection of individual and business rights.

3. Member States may apply this Article taking into account, mutatis mutandis, Articles 53 to 61 of Directive 2013/36/EU.

Article 27 Right to apply to the courts

1. Member States shall ensure that decisions taken by the competent authorities in respect of a payment institution pursuant to the laws, regulations and administrative provisions adopted in accordance with this Directive are subject to appeal.

2. Paragraph 1 shall apply also in respect of a failure to act where this Directive sets a fixed period for the competent authority to act.

Article 28 Cooperation and exchange of information

1. The competent authorities of the different Member States shall cooperate with each other and, where appropriate, with the ECB and the national central banks of the Member States, the EBA and other relevant competent authorities designated under Union or national law applicable to payment service providers.

2. Member States shall allow for the exchange of information between their competent authorities and:

(a) the competent authorities of other Member States responsible for the authorisation of applicant payment institutions and the supervision of payment institutions;

(b) the ECB and the national central banks of Member States, in their capacity as monetary and oversight authorities, and, where appropriate, other public authorities responsible for overseeing payment and settlement systems;

(c) other relevant authorities designated under this Directive, and other Union law applicable to payment service providers, including Directive (EU) 2015/849;

(d) the EBA, in its capacity of contributing to the effective and consistent functioning of supervising mechanisms as referred to in Article 1(5), point (a), of Regulation (EU) No 1093/2010.

Article 29 Settlement of disagreements between competent authorities of different Member States

1. A competent authority of a Member State that considers that, in a particular matter, cross-border cooperation with competent authorities of another Member State as referred to in Articles 28, 30, 31, 32 or 33 does not comply with the conditions set out in those provisions may refer the matter to the EBA and request its assistance in accordance with Article 19 of Regulation (EU) No 1093/2010.

2. Where the EBA has been requested to assist pursuant to paragraph 1, it shall take a decision under Article 19(3) of Regulation (EU) No 1093/2010 without undue delay. The EBA may also assist the competent authorities in reaching an agreement on its own initiative in accordance with Article 19(1), second subparagraph, of that Regulation. In either case, the competent authorities involved shall defer their decisions pending resolution under Article 19 of that Regulation.

Article 30 Application to exercise the right of establishment and freedom to provide services

1. Member States shall ensure that any payment institution wishing to start providing payment ▌ services ▌ in a Member State other than its home Member State, including via an establishment in a third Member State, in the exercise of the right of establishment or the freedom to provide services, ▌ communicates the following information to the competent authorities in its home Member State:

(a) the name, the address and, where applicable, the authorisation number of the payment institution;

(b) the Member State(s) in which the payment institution intends to operate and planned date of commencement of operations in this Member State;

(c) the payment ▌ service(s) that the payment institution intends to provide;

(d) where the payment institution intends to make use of an agent ▌ , the information referred to in Articles 19(1) ▌ ;

(e) where the payment institution intends to make use of a branch:

(i) the information referred to in Article 3(3), points (b) and (e), with regard to the payment ▌ service business in the host Member State;

(ii) a description of the organisational structure of the branch;

(iii) mutatis mutandis, the information referred to in Article 19(1), points (a) to (i);

▌

Member States shall ensure that payment institutions that intend to outsource operational functions of the payment ▌ services to other entities in the host Member State, without undue delay, inform the competent authorities of their home Member State thereof.

▌

2. Within 10 business days of receipt of all of the information referred to in paragraph 1, the competent authorities of the home Member State shall send that information to the competent authorities of the host Member State. Where the services are provided via a third Member State, the Member State to be notified shall be the one where the services are provided to payment service users.

Within 1 month of receipt of the information from the competent authorities of the home Member State, the competent authorities of the host Member State shall assess that information and provide the competent authorities of the home Member State with relevant information about the intended provision of payment ▌ services by the relevant payment institution in the exercise of the freedom of establishment or the freedom to provide services. The competent authorities of the host Member State shall inform the competent authorities of the home Member State of any grounds for concern in connection with the intended engagement of an agent ▌ or establishment of a branch with regard to money laundering or terrorist financing within the meaning of Directive (EU) 2015/849. Before doing so, the competent authority of the host Member State shall liaise with the relevant competent authorities as referred to in Article 7(2) of Directive (EU) 2015/849 to establish whether such grounds exist.

Competent authorities of the home Member State that do not agree with the assessment of the competent authorities of the host Member State shall provide the competent authorities of the host Member State with the reasons for their disagreement.

Where the assessment of the competent authorities of the home Member State, in light of the information received from the competent authorities of the host Member State is not favourable, the competent authority of the home Member State shall refuse to register the agent, branch ▌ , or shall withdraw the registration if already made.

3. Within 10 weeks of receipt of the information referred to in paragraph 1, the competent authorities of the home Member State shall communicate their decision to the competent authorities of the host Member State and to the payment institution.

Upon entry in the register referred to in Article 17, the agent ▌ or branch may commence its activities in the relevant host Member State.

Member States shall ensure that the payment institution notifies to the competent authorities of the home Member State the start date of the activities conducted on the payment institution’s behalf through the agent ▌ or branch in the host Member State concerned. The competent authorities of the home Member State shall inform the competent authorities of the host Member State thereof.

4. Member States shall ensure that the payment institution communicates to the competent authorities of the home Member State any relevant change regarding the information communicated in accordance with paragraph 1 without undue delay, including additional agents, ▌ branches or entities to which activities are outsourced in the host Member States in which the payment institution operates. The procedure provided for under paragraphs 2 and 3 shall apply.

5. The EBA shall develop draft regulatory technical standards specifying the framework for cooperation, and for the exchange of information, between competent authorities of the home and of the host Member State in accordance with this Article. Those draft regulatory technical standards shall specify the method, means and details of cooperation in the notification of payment institutions operating on a cross-border basis and, in particular, the scope and treatment of information to be submitted, including common terminology and standard notification templates to ensure a consistent and efficient notification process, including in the case where an agent or branch of a payment institution, located in a host Member State, offers payment services in a third Member State.

The EBA shall submit those draft regulatory technical standards to the Commission by [ OP please insert the date= 18 months after the date of entry into force of this Directive].

Power is delegated to the Commission to adopt the regulatory technical standards in accordance with Article 10 to 14 of Regulation (EU) No 1093/2010.

Article 31 Supervision of payment institutions exercising the right of establishment and freedom to provide services

1. When carrying out the controls and taking the necessary steps provided for in this Title and Titles II and III of Regulation XXX (PSR) in respect of the agent ▌ or branch of a payment institution located in the territory of another Member State, the competent authorities of the home Member State shall cooperate with the competent authorities of the host Member State, including by informing the competent authorities of the host Member State of where they intend to carry out an on-site inspection in the territory of that host Member State.

The competent authorities of the home Member State may delegate to the competent authorities of the host Member State the task of carrying out on-site inspections of the payment institution concerned.

2. The competent authorities of the host Member States may require that payment institutions having agents ▌ or branches within their territories report to them periodically about the activities carried out in their territories.

Such reports shall be required for information or statistical purposes and, as far as the agents ▌ or branches provide payment ▌ services, to monitor compliance with Titles II and III of Regulation XXX [PSR]. Such agents ▌ or branches shall be subject to professional secrecy requirements that are at least equivalent to those referred to in Article 26.

The competent authorities of the host Member State may request ad hoc information from payment institutions where those authorities have evidence of non-compliance with this Title or with Titles II and III of Regulation XXX [PSR].

3. The competent authorities of the home and host Member States shall provide each other with all essential or relevant information, in particular in the case of infringements or suspected infringements by an agent ▌ or a branch, and where such infringements occurred in the context of the exercise of the freedom to provide services. Competent authorities shall communicate, upon request, all relevant information and, on their own initiative, all essential information, including on the compliance of the payment institution with the conditions laid down in Article 13(3).

4. Member States may require payment institutions operating on their territory through agents, the head office of which is situated in another Member State, to appoint a central contact point in their territory to ensure adequate communication and information reporting in compliance with Titles II and III of Regulation XXX [PSR], and to facilitate supervision by competent authorities of home Member State and host Member States, including by providing competent authorities with documents and information on request. Where a Member State decides to impose such a requirement, each payment institution shall appoint only one central contact point in that Member State.

5. For the purposes of paragraph 4, payment institutions shall be required to appoint a central contact point only where one or more of the following criteria is met:

(a) the total number of agents through which a payment institution provides any of the payment services referred to in Annex I in a host Member State under the right of establishment is equal to or exceeds 10;

(b) the total value of payment transactions, including payment transactions initiated when providing payment initiation services, carried out by a payment institution in the host Member State in the last financial year through agents located in the host Member State and operating under either the right of establishment or the freedom to provide services, exceeds EUR 3 million and the payment institution has engaged at least two of those agents under the right of establishment;

(c) the total number of payment transactions carried out by a payment institution in the host Member State in the last financial year through agents located in the host Member State and operating under either the right of establishment or the freedom to provide services, including the number of payment transactions initiated when providing payment initiation services, exceeds 100 000 and the payment institution has engaged at least two of those agents under the right of establishment.

A central contact point that is appointed pursuant to paragraph 4 shall carry out each of the following functions: (a) it shall serve as single provider and single point of collection for the purposes of the reporting obligations of the appointing payment institution towards the competent authorities of the host Member State pursuant to paragraph 2 in relation to services provided in the host Member State through agents under the right of establishment; (b) it shall serve as single point of contact of the appointing payment institution in communications with the competent authorities of the home and host Member States, in relation to the payment services provided in the host Member State through agents under the right of establishment, including by providing competent authorities with documents and information on request; (c) it shall facilitate the on-site inspections by competent authorities of the agents of the appointing payment institution operating in the host Member State under the right of establishment and the implementation of any supervisory measures adopted by the competent authorities of the home or host Member States pursuant to this directive.

7. ▌Payment institutions shall ensure that a central contact point possesses the necessary resources and has access to all the data necessary for the performance of the functions set out in in paragraph 6.

▌

Article 32 Measures in case of non-compliance, including precautionary measures

1. Where a competent authority of a host Member State considers that a payment institution having agents ▌ or branches in its territory does not comply with this Title or with Titles II and III of Regulation XXX [PSR], that competent authority shall inform the competent authority of the home Member State thereof without undue delay.

The competent authority of the home Member State, after having evaluated the information received pursuant to the first subparagraph, shall, without undue delay, take all appropriate measures to ensure that the payment institution concerned puts an end to its failure of compliance. The competent authority of the home Member State shall communicate those measures to the competent authority of the host Member State and to the competent authorities of any other Member State concerned without delay.

2. In emergency situations, where immediate action is necessary to address a serious threat to the collective interests of the payment service users in the host Member State, the competent authorities of the host Member State may, in parallel to the cross-border cooperation between competent authorities and pending measures by the competent authorities of the home Member State as set out in Article 31, take precautionary measures.

3. Any precautionary measures as referred to in paragraph 2 shall be appropriate and proportionate to their purpose to protect against a serious threat to the collective interests of the payment service users in the host Member State. Those measures shall not result in a preference for payment service users of the payment institution in the host Member State over payment service users of the payment institution in other Member States.

Precautionary measures shall be temporary and shall be terminated when the serious threats identified have been addressed, including with the assistance of or in cooperation with the home Member State’s competent authorities or with the EBA as provided for in Article 29(1).

4. Where compatible with the emergency situation, the competent authorities of the host Member State shall inform the competent authorities of the home Member State and those of any other Member State concerned, the Commission and the EBA of the precautionary measures taken under paragraph 2 and of their justification in advance and in any case without undue delay.

Article 33 Reasons and communication

1. Any measure taken by the competent authorities pursuant to Article 25, 30, 31 or 32 involving penalties or restrictions on the exercise of the freedom to provide services or the freedom of establishment shall be properly justified and communicated to the payment institution concerned.

2. Articles 30, 29 and 32 shall be without prejudice to the obligation of competent authorities under Directive (EU) 2015/849 and Regulation (EU) 2023/1113, in particular under Article 47(1) of Directive (EU) 2015/849 and Article 33(1) of Regulation (EU) 2023/1113, to supervise or monitor the compliance with the requirements laid down in those instruments.

CHAPTER II Exemptions and notifications

Article 34 Optional exemptions

1. Member States may exempt, or allow their competent authorities to exempt, natural or legal persons providing any of the payment services as referred to in Annex I, points (1) to (5), and (8) from the application of all or part of the procedures and conditions set out in Chapter I, Sections 1, 2 and 3, with the exception of Articles 17, 18, 24, 26, 27 and 28, where:

(a) in the case of payment services referred to points (1) to (5) of Annex 1, the monthly average of the preceding 12 months’ total value of payment transactions executed by the person concerned, including any agent for which the person concerned assumes full responsibility, does not exceed a limit set by the Member State but that, in any event, amounts to no more than EUR 3 million; or

(b) in the case of the payment service referred to in point (8) of Annex 1, the total business activities generate an average amount of outstanding electronic money that does not exceed a limit set by the Member State but that, in any event, does not exceed EUR 5 million; and

(c) in the case of payment services referred to in Annex I, points (1) to (5) and (8), none of the natural persons responsible for the management or operation of the business has been convicted of offences relating to money laundering or terrorist financing or other financial crimes.

▌

For the purposes of the subparagraph, point (a), the assessment of whether the limit has been exceeded shall be based on the projected total amount of payment transactions in its business plan, unless the competent authorities have required an adjustment to that plan.

Where a payment institution providing the payment service referred to in point (8) of Annex 1 also offers any other payment service or any of the activities referred to in Article 10, and the amount of outstanding electronic money is unknown in advance, the competent authorities shall allow that payment institution to apply the first subparagraph point (b), on the basis of a representative portion assumed to be used for the payment service referred to in point (8) of Annex 1, provided that such a representative portion can be reasonably estimated on the basis of historical data and to the satisfaction of the competent authorities. Where a payment institution has not completed a sufficiently long period of business, that requirement shall be assessed on the basis of projected outstanding electronic money evidenced by its business plan subject to any adjustment to that plan required by the competent authorities.

Member States may also provide for the granting of the optional exemptions to be subject to an additional requirement of a maximum storage amount on the payment instrument or payment account of the consumer where the electronic money is stored.

A natural or legal person benefitting from an exemption under paragraph 1, first subparagraph, point (b), may provide payment services not related to issuing money ▌ only in accordance with paragraph 1, first subparagraph, point (a).

2. Member States shall require any natural or legal person exempted from the application of the procedures and conditions referred to in paragraph 1 to register with the competent authority of the home Member State. Member States shall determine the documentation which shall accompany such request for registration, from the elements listed in Article 3(3) points (a) to (s).

3. Member States shall require any natural or legal person registered in accordance with paragraph 2 to have its head office or place of residence in the Member State in which it actually carries out its business.

4. The persons exempted from the application of the procedures and conditions referred to in paragraph 1 shall be treated as payment institutions. Article 13(6) and Articles 30, 31 and 32 shall not apply to those persons.

5. Member States may provide that any natural or legal person registered in accordance with paragraph 2 may engage only in certain activities listed in Article 10.

6. The persons exempted from the application of the procedures and conditions referred to in paragraph 1 shall notify the competent authorities of any change in their situation which is relevant to the conditions specified in that paragraph, and at least annually, on the date specified by the competent authorities, report on the following:

(a) the average of the preceding 12 months’ total value of payment transactions where they provide payment services;

(b) the average outstanding electronic money where they issue electronic money ▌ .

7. Member States shall take the necessary steps to ensure that where the conditions set out in paragraphs 1, 3 or 5 of this Article are no longer met, the persons concerned shall seek authorisation within 30 calendar days in accordance with Article 13. Member States shall ensure that their competent authorities are sufficiently empowered to verify continued compliance with this Article.

8. Paragraphs 1 to 6 of this Article shall be without prejudice to Directive (EU) 2015/849 or of national laws on anti-money laundering or terrorist financing.

Article 35 Notification and information

A Member State that decides to grant an exemption as referred to in Article 34 shall inform the Commission of all of the following:

(a) its decision to grant such an exemption;

(b) any subsequent change to this exemption;

(c) the number of natural and legal persons concerned;

(d) on an annual basis, the total value of payment transactions executed as of 31 December of each calendar year, as referred to in Article 34(1), point (a), and of the total amount of outstanding electronic money issued, as referred to in Article 34(1), point (b).

Article 36 Account information service providers

1. Natural or legal persons providing only the payment service referred to in Annex I, point (7), shall not be subject to authorisation but shall register with the competent authority of the home Member State before taking up activity.

2. Such registration request shall be accompanied by the information and documentation referred to in Article 3(3), points (a), (b), (e) to (h), (j), (l), (n), (p) and (q).

For the purposes of the documentation referred to in Article 3(3), points (e), (f) and (l), the natural or legal person registering shall provide a description of its audit arrangements and of the organisational arrangements it has set up with a view to taking all reasonable steps to protect the interests of its users and to ensure continuity and reliability in the performance of the payment service as referred to in Annex I, point (7).

3. The security control and mitigation measures referred to in Article 3(3), point (j), shall indicate how the natural or legal person registering will ensure a high level of digital operational resilience in accordance with Chapter II of Regulation (EU) 2022/2554, in particular in relation to technical security and data protection, including for the software and ICT systems used by the natural or legal person registering or the undertakings to which it outsources the whole or part of its operations.

4. Member States shall require persons as referred to in paragraph 1, as a condition of their registration, to hold a professional indemnity insurance covering the territories in which they offer services, or some other comparable guarantee, and that they ensure that:

(a) they can cover their liability vis-à-vis the account servicing payment service provider or the payment service user resulting from non-authorised or fraudulent access to or non-authorised or fraudulent use of payment account information service;

(b) they can cover the value of any excess, threshold or deductible from the insurance or comparable guarantee;

(c) they monitor the coverage of the insurance or comparable guarantee on an ongoing basis.

For the purpose of the first subparagraph, the professional indemnity insurance or the other comparable guarantee shall be in place at the moment when the applicant starts providing payment services.

5. Sections 1 and 2 of Chapter I shall not apply to the persons providing the services referred to in paragraph 1 of this Article. Section 3 of Chapter I shall apply to the persons providing the services referred to in paragraph 1 of this Article, with the exception of Article 25(3).

▌

6. The persons referred to in paragraph 1 of this Article shall be treated as payment institutions.

Article 37 Services where cash is provided in retail stores without a purchase

1. Without prejudice to paragraph 1b, Member States shall exempt from the application of this Directive natural or legal persons providing cash in retail stores independently of any purchase provided the following conditions are met:

(a) the service is offered at its premises by a natural or legal person selling goods or services as a regular occupation;

(b) the amount of cash provided per withdrawal does not exceed EUR 150, or the equivalent in national currency;

(ba) the client’s withdrawal is subject to strong customer authentication.

Member States may adopt lower limit than the one specified in point (b) of this paragraph, but not lower than EUR 100, or the equivalent in national currency.

1a. Member States may provide for a daily withdrawal limit per payment account for the services as exempted under paragraph 1. The limit shall be set at an adequate level to ensure the protection against money laundering and countering terrorist financing risks and shall not be lower than EUR 200.

1b. The payment service user shall be provided with information on any charges for the service provided in accordance with paragraph 1 before the requested cash is provided.

2. This Article shall be without prejudice to Directive (EU) 2015/849 or any other relevant Union or national anti-money-laundering/terrorist financing laws.

Article 38 Services enabling cash withdrawals offered by ATM deployers not servicing payment accounts

1. ATM deployers shall not be subject to authorisation but shall register, before taking up activity, with the competent authority of the ▌ Member State where the cash withdrawal services are intended to be provided.

2. The registration referred to in paragraph 1 shall be accompanied by the information and documentation referred to in Article 3(3), points (a), (b), (e) to (h), (j) to (l), (n), (p) and (q).

For the purposes of the documentation referred to in Article 3(3), points (e), (f) and (l), the ▌ person registering shall provide a description of its audit arrangements and of the organisational arrangements it has set up to taking all reasonable steps to protect the interests of its users and to ensure continuity and reliability in the performance of the payment service as referred to in point (1) of Annex I.

The security control and mitigation measures referred to in Article 3(3), point (j), shall indicate how the ▌ person registering will ensure a high level of digital operational resilience in accordance with Chapter II of Regulation (EU) 2022/2554, in particular in relation to technical security and data protection, including for the software and ICT systems used by the ▌ person registering or the undertakings to which it outsources the whole or part of its operations.

2a. The competent authority referred to in paragraph 1 may refuse a registration, and may revoke a registration, if the competent authority establishes that the ATM deployer does not comply with, or has ceased to comply with, any of the requirements set out in paragraph 2. The competent authority shall provide a justification for the refusal or revocation.

3. Sections 1 and 2 of Chapter 1 shall not apply to the persons providing the services referred to in paragraph 1 of this Article. Section 3 of Chapter 1 shall apply to the persons providing the services referred to in paragraph 1 of this Article, with the exception of Articles 25(3) and 30.

4. The persons providing the services referred to in paragraph 1 of this Article shall be treated as payment institutions.

Article 39 Duty of notification

1. Member States may require service providers that carry out either of the activities referred to in Article 2(2), points (j), (i) and (ii), of Regulation XXX [PSR] or carry out both activities, for which the total value of payment transactions executed over the preceding 12 months exceeds EUR 1 million, to inform the competent authorities about the services offered, specifying under which exclusion as referred to Article 2(2), points (j), (i) and (ii), of Regulation XXX [PSR] the activity is considered to be carried out.

Member States shall ensure that competent authorities are entitled to require any service providers that carry out either of the activities referred to in Article 2(2), points (j), (i) and (ii), of Regulation XXX [PSR], or carry out both activities, to inform those authorities about the services offered, specifying under which exclusion as referred to Article 2(2), points (j), (i) and (ii), of Regulation XXX [PSR] the activity is considered to be carried out.

Where a competent authority has received information pursuant to subparagraph 1 or 2, and where the activity does not qualify as a limited network, the competent authority shall take a duly motivated decision on the basis of criteria referred to in Article 2(2), point (j), (i) and (ii), of Regulation XXX [PSR] ▌ , and inform the service provider thereof.

2. Member States may require service providers that carry out an activity as referred to in Article 2(2), point (k), of Regulation XXX [PSR], to send a notification to competent authorities and provide competent authorities an annual audit opinion, testifying that the activity complies with the limits set out Article 2(2), point (k), of Regulation XXX [PSR].

Member States shall ensure that competent authorities are entitled to require providers that carry out an activity as referred to in Article 2(2), point (k), of Regulation XXX [PSR], to send those authorities an annual audit opinion, testifying that the activity complies with the limits set out Article 2(2), point (k), of Regulation XXX [PSR].

3. Member States shall ensure that competent authorities ▌ inform the EBA of the services of which they are informed pursuant to paragraph 1, stating under which exclusion the activity is carried out.

4. The description of the activity of which the competent authorities are informed under paragraphs 1 and 2 shall be made publicly available in the registers referred to in Articles 17 and 18.

TITLE III DELEGATED ACTS AND REGULATORY TECHNICAL STANDARDS

Article 40 Delegated acts

The Commission shall be empowered to adopt delegated acts in accordance with Article 41 to update the amounts referred to in Article 5, Article 34(1), and Article 37 to take account of inflation.

Article 41 Exercise of the delegation

1. The power to adopt delegated acts is conferred on the Commission subject to the conditions laid down in this Article.

2. The power to adopt delegated acts referred to in Article 40 shall be conferred on the Commission for an undetermined period of time from the date of entry into force of this Directive.

3. The delegation of power referred to in Article 40 may be revoked at any time by the European Parliament or by the Council. A decision to revoke shall put an end to the delegation of the power specified in that decision. It shall take effect on the day following the publication of the decision in the Official Journal of the European Union or on a later date specified therein. It shall not affect the validity of any delegated acts already in force.

4. As soon as it adopts a delegated act, the Commission shall notify it simultaneously to the European Parliament and to the Council.

5. A delegated act adopted pursuant to Article 40 shall enter into force only if no objection has been expressed either by the European Parliament or the Council within a period of 3 months of notification of that act to the European Parliament and the Council or if, before the expiry of that period, the European Parliament and the Council have both informed the Commission that they will not object. That period shall be extended by 3 months at the initiative of the European Parliament or of the Council.

TITLE IV FINAL PROVISIONS

Article 42 Full harmonisation

1. Without prejudice to Articles 6(3), 34, 37 and 39, insofar as this Directive contains harmonised provisions, Member States shall not maintain or introduce provisions other than those laid down in this Directive.

2. A Member State that uses any of the options referred to in Articles 6(3), 34, 37 or 39, shall inform the Commission thereof and of any subsequent changes. The Commission shall make the information public on a website or other easily accessible means.

3. Member States shall ensure that payment service providers do not derogate, to the detriment of payment service users, from the provisions of national law transposing this Directive except where explicitly provided for therein. However, payment service providers may decide to grant more favourable terms to payment service users.

Article 43 Review clause

1. The Commission shall, by [ ▌ OP please insert the date = 7 years after entry into force of this Directive], submit to the European Parliament, the Council, the ECB and the European Economic and Social Committee, a report on the application and impact of this Directive, and in particular on:

(a) the appropriateness of the scope of this Directive, in particular regarding the possibility of extending it to certain services, including the operation of payment systems and the provision of technical services ▌ , which are not covered in the scope;

(b) the impact of the revision of Directive 2014/49/EU on the safeguarding of customer funds by payment institutions;

(ba) the provisions on services whereby cash is provided in retail stores without a purchase, especially on the need of further harmonisation of these provisions;

(bb) the total number and market share of payment service providers authorised under this Directive, classified per each Member State.

Where appropriate, the Commission shall submit a legislative proposal together with its report.

2. The Commission shall ▌ by [ OP please insert the date = three years after entry into force of this Directive], submit to the European Parliament, the Council, the ECB and the European Economic and Social Committee, a report on the scope of this Directive, with regard in particular to payment systems, payment schemes and technical service providers. The report shall also cover the current applications of the payment service referred to in Annex I, point (8), and its key features, including in particular the distinction between accounts used to store electronic money and traditional payment accounts. Where appropriate, the Commission shall submit a legislative proposal together with its report.

2a. The Commission shall by [ OP please insert the date = 18 months after entry into force of this Directive], submit to the European Parliament, the Council, the ECB and the European Economic and Social Committee, a report on the possibility of extending the scope of this Directive to the processing or the operating of digital wallets. Where appropriate, the Commission shall submit a legislative proposal together with its report.

Article 44 Transitional provisions

1. Member States shall allow payment institutions that have been authorised pursuant to Article 11 of Directive (EU) 2015/2366 by ... [21 months after the date of entry into force of this Directive] to continue to provide and execute the payment services for which they have been authorised, without having to ▌ seek a new authorisation in accordance with Article 3 of this Directive or to comply with the other provisions laid down or referred to in Title II of this Directive until ... [27] months after the date of entry into force of this Directive].

Member States shall require such payment institutions as referred to in the first subparagraph to submit to the competent authorities the information necessary for those competent authorities to assess, by ... [27] months after the date of entry into force of this Directive], either of the following:

(a) whether those payment institutions comply with Article 3(3), points (c), (d), (e), (f), (h), (r) and (s), and, where not, which measures need to be taken to ensure compliance;

(b) whether the authorisation should be withdrawn.

Payment institutions as referred to in the first subparagraph which upon verification by the competent authorities comply with Title II shall be deemed to be authorised as payment institutions pursuant to Article 13 of this Directive and shall be entered in the registers referred to in Articles 17 and 18. Where those payment institutions do not comply with the requirements laid down in Title II by ... [27 months after the date of entry into force of this Directive], they shall be suspended from providing payment services until they provide to the relevant competent authority the necessary information which ensures their compliance with Title II and competent authority has verified and confirmed the accuracy of that information.

2. By way of derogation from paragraph 1, second subparagraph, Member States shall provide for payment institutions as referred to in paragraph 1 to be authorised automatically and be entered in the register referred to in Article 17 if the competent authorities have evidence that those payment institutions already comply with Articles 3 and 13. The competent authorities shall inform the payment institutions concerned of such automatic authorisation before the authorisation is granted.

3. Member States shall allow natural or legal persons who benefited from an exemption pursuant to Article 32 of Directive (EU) 2015/2366 by ... [21 months after the date of entry into force of this Directive], and provided payment services as referred to in Annex I to that Directive, to do any of the following:

(a) to continue to provide those services within the Member State concerned until ... [27 months after the date of entry into force of this Directive];

(b) to obtain an exemption pursuant to Article 34 of this Directive or,

(c) to comply with the other provisions laid down or referred to in Title II of this Directive.

Any person as referred to in the first subparagraph who has not, by ... [21 months after the date of entry into force of this Directive], been authorised or exempted under this Directive shall be suspended from providing payment services until that person provides to the relevant competent authority the necessary information and that competent authority has verified and confirmed the accuracy of that information. Article 34(7) shall apply.

4. By way of derogation from paragraph 3, first subparagraph, point (b), Member States may provide for natural and legal persons who benefited from an exemption pursuant to Article 32 of Directive (EU) 2015/2366 to be exempted pursuant to Article 34 of this Directive and to be entered in the registers referred to in Articles 17 and 18 of this Directive where the competent authorities have evidence that the requirements laid down in Article 34 of this Directive are complied with. The competent authorities shall inform the payment institutions concerned thereof.

4a. Member States shall ensure that ATM deployers not servicing payment accounts that are operating in the market pursuant to Article 3, point (o) of Directive (EU) 2015/2366 by ... [21 months after the date of entry into force of this Directive] may continue to provide this service without having to seek registration in accordance with Article 38 or to comply with the other provisions laid down or referred to in Title II until ... [27 months after the date of entry into force of this Directive].

4b. Member States shall ensure that in relation to the institutions mentioned in paragraphs 1 to 4, the register referred to in Article 17 is updated [one week after ... [27 months after the date of entry into force of this Directive].

4c. Pursuant to Article 18, competent authorities shall provide the EBA, in relation to the institutions referred to in paragraph 4b of this Article, with the information entered in their register referred to in Article 17, immediately after the update of that register pursuant to paragraph 4b of this Article.

Article 45 Transitional provision – electronic money institutions authorised under Directive 2009/110/EC

1. Member States shall allow electronic money institutions as defined in Article 2, point (1), of Directive 2009/110/EC that have taken up, before ... [21 months after the date of entry into force of this Directive], activities in accordance with national law transposing Directive 2009/110/EC as electronic money institutions in the Member State in which their head office is located in accordance with national law transposing Directive 2009/110/EC, to continue those activities in that Member State or in another Member State without having to seek a new authorisation in accordance with Article 3 of this Directive or to comply with the other provisions laid down or referred to in Title II of this Directive, until ... [27 months from the date of entry into force of this Directive].

2. Member States shall require the electronic money institutions referred in paragraph 1 to submit to the competent authorities all information necessary for those competent authorities ▌ to assess, by ... [27 months after the date of entry into force of this Directive], whether those electronic money institutions comply with Article 3(3), points (c), (d), (e), (f), (h), (r) and (s). Where such assessment reveals that those electronic money institutions do not comply with those requirements, the competent authorities shall decide which measures need to be taken to ensure such compliance, or to withdraw the authorisation.

Electronic money institutions as referred to in the first subparagraph which upon verification by the competent authorities comply with Title II shall be deemed to be authorised as payment institutions pursuant to Article 13 of this Directive, shall be entered in the registers referred to in Articles 17 and 18. Where those electronic money institutions do not comply with the requirements laid down in Title II by ... [27 months after the date of entry into force of this Directive], they shall be suspended from providing payment services until they provide to the relevant competent authority the necessary information and that competent authority has verified and confirmed the accuracy of that information. Article 34(7) shall apply.

3. By way of derogation from paragraph 2, first subparagraph, Member States shall allow electronic money institutions as referred to in paragraph 1 to be authorised automatically as payment institutions and entered in the register referred to in Article 17 where the competent authorities have evidence that the electronic money institutions concerned comply with this Directive. The competent authorities shall inform the electronic money institutions concerned thereof before such automatic authorisation is granted.

4. Member States shall allow legal persons that have taken up, before ... [21 months after the date of entry into force of this Directive], activities in accordance with national law transposing Article 9 of Directive 2009/110/EC, to continue those activities within the Member State concerned in accordance with that Directive until ... [27 months after the date of entry into force of this Directive], without being required to seek a new authorisation under Article 3 of this Directive or to comply with the other provisions laid down or referred to in Title II of this Directive. Electronic money institutions as referred to in paragraph 1 which, during that period, have been neither authorised nor exempted within the meaning of Article 34 of this Directive, shall be suspended from providing payment services, until they provide to the relevant competent authority the necessary information and that competent authority has verified and confirmed the accuracy of that information. Article 34(7) shall apply.

Article 45a Extension period

Competent authorities may exceptionally decide to extend, by no longer than 3 months, the period before specific payment institutions and electronic money institutions are prohibited from providing services when those institutions provided the information required pursuant to Articles 44 and 45 and the competent authority has not been able to process it within the applicable deadline.

Article 46 Amendments to Directive 98/26/EC

Article 2 of Directive 98/26/EC is amended as follows:

(1) point (b) is replaced by the following:

‘(b) ‘institution’ shall mean ▌ :

- a credit institution as defined in Article 4(1), point (1), of Regulation (EU) No 575/2013 of the European Parliament and of the Council*, including the entities listed in Article 2(5) of Directive 2013/36/EU;

- an investment firm as defined in Article 4(1), point (1), of ▌ Directive 2014/65/EU of the European Parliament and of the Council**), ▌ excluding the institutions set out in Article 2(1) thereof ▌ ,

- public authorities and publicly guaranteed undertakings, or

- any undertaking whose head office is outside the Union and whose functions correspond to those of the Union credit institutions or investment firms [as defined in the first and second indent] ▌ ,

which participates in a system and which is responsible for discharging the financial obligations arising from transfer orders within that system ▌ ;

- a payment institution as defined in Article 2, point (4), of Directive XXX [PSD3], with the exception of payment institutions benefitting from an exemption pursuant to Articles 34, 36 and 38 of that Directive,

which participates in a system whose business consists of the execution of transfer orders as defined in point (i), first indent, and which is responsible for discharging the financial obligations arising from such transfer orders within that system.

If a system is supervised in accordance with national legislation and only executes transfer orders as defined in point (i), second indent, as well as payments resulting from such orders, a Member State may decide that undertakings which participate in such a system and which have responsibility for discharging the financial obligations arising from transfer orders within this system, can be considered institutions, provided that at least three participants of this system are covered by the categories referred to in the first subparagraph of this point and that such a decision is warranted on grounds of systemic risk; ’.’

▌

Article 48 Repeal

Directive (EU) 2015/2366 is repealed with effect from ... [21 months after entry into force of this Directive].

Directive 2009/110/EC is repealed with effect from ... [21 months after entry into force of this Directive ▌ .

All references made to Directive (EU) 2015/2366 and to Directive 2009/110/EC in legal acts that are in force at the time this Directive enters into force shall be construed as references to this Directive or Regulation XXX [PSR] and shall be read in accordance with the correlation table in Annex III to this Directive.

Article 49 Transposition

1. Member States shall adopt and publish, by ... [21 months after entry into force of this Directive] at the latest ▌ the laws, regulations and administrative provisions necessary to comply with this Directive. They shall forthwith communicate to the Commission the text of those provisions.

2. They shall apply those measures from ... [21 months after entry into force of this Directive] ▌ .

When Member States adopt those measures, they shall contain a reference to this Directive or be accompanied by such reference on the occasion of their official publication. Member States shall determine how such reference is to be made.

3. Member States shall communicate to the Commission the text of the main measures of national law which they adopt in the field covered by this Directive.

Article 50 Entry into force

This Directive shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

Article 51 Addresses

This Directive is addressed to the Member States.

Done at ...........,

For the European Parliament For the Council

The President The President

Annex I

PAYMENT SERVICES

(as referred to in point 3 of Article 2)

1. Services enabling cash to be placed on and/or withdrawn from a payment account.

2. Execution of payment transactions, including transfers of funds from and to a payment account, including where the funds are covered by a credit line with the user´s payment service provider or with another payment service provider.

3. Issuing of payment instruments.

4. Acquiring of payment transactions.

5. Money remittance.

6. Payment initiation services.

7. Account information services.

8. Issuance of electronic money.

▌